[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-55252 | 1 Oct 2026 | CVSS 5.1 | openrundev openrunOpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7… | |
| CVE-2026-56660 | 1 Oct 2026 | CVSS 9.1 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update… | |
| CVE-2026-56661 | 1 Oct 2026 | CVSS 7.5 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update… | |
| CVE-2026-56662 | 1 Oct 2026 | CVSS 9.6 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE… | |
| CVE-2026-53953 | 1 Oct 2026 | CVSS 9.1 | GetSimpleCMS-CEGetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset… | |
| CVE-2026-53964 | 1 Oct 2026 | CVSS 7.2 | adfinis document-merge-serviceDocument Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version… | |
| CVE-2026-54049 | 1 Oct 2026 | CVSS 8.7 | sakaiproject sakaiSakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations… | |
| CVE-2026-55251 | 1 Oct 2026 | CVSS 6.5 | netbox-community devicetype-libraryNetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the CI… | |
| CVE-2026-104286 | 1 Oct 2026 | CVSS 9.8 | Unauthenticated file write in Fortinet FortiMailAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail… | ExploitedFix |
| CVE-2026-14983 | 1 Oct 2026 | CVSS 7.1 | Teledyne FLIR Aware2Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve… | |
| CVE-2026-14984 | 1 Oct 2026 | CVSS 9.4 | Teledyne FLIR Aware2Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to… | |
| CVE-2026-103484 | 1 Oct 2026 | CVSS 8.8 | pgvectorIVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution. | |
| CVE-2026-102669 | 1 Oct 2026 | CVSS 5.3 | Joyland.aiJoyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages. | |
| CVE-2026-102670 | 1 Oct 2026 | CVSS 4.3 | Joyland.aiJoyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it. | |
| CVE-2026-102671 | 1 Oct 2026 | CVSS 5.3 | Joyland.aiThe Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default. | |
| CVE-2026-102628 | 1 Oct 2026 | CVSS 9.3 | Eummena Cadmos LTIThe Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible… | |
| CVE-2026-102666 | 1 Oct 2026 | CVSS 6.5 | Joyland.aiThe Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and… | |
| CVE-2026-102667 | 1 Oct 2026 | CVSS 8.3 | Joyland.aiJoyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions… | |
| CVE-2026-102668 | 1 Oct 2026 | CVSS 5.3 | Joyland.aiThe Joyland AI app accepts any TLS certificates from any server without validation. | |
| CVE-2026-100251 | 1 Oct 2026 | CVSS 6.5 | Wormhole App WormholeWormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an… | |
| CVE-2026-8618 | 1 Oct 2026 | CVSS 7.7 | TP-Link Systems Inc. Deco M9 Plus V2A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted… | |
| CVE-2026-84682 | 1 Oct 2026 | CVSS 7.7 | TP-Link Systems Inc. Archer AX90 v1A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can… | |
| CVE-2026-55083 | 1 Oct 2026 | CVSS 9.1 | dhis2-coreDHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before… | |
| CVE-2026-55230 | 1 Oct 2026 | CVSS 8.7 | givanz VvvebVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML… | |
| CVE-2026-55231 | 1 Oct 2026 | CVSS 7.2 | givanz VvvebVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central… | |
| CVE-2026-55232 | 1 Oct 2026 | CVSS 7.6 | givanz VvvebVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard… | |
| CVE-2026-27872 | 1 Oct 2026 | CVSS 5.6 | Johnson Controls Easy IO FG- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects Easy IO FG: before 2.0b52. | |
| CVE-2026-104056 | 1 Oct 2026 | CVSS 9.8 | AuthlibAuthlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This… | |
| CVE-2026-104057 | 1 Oct 2026 | CVSS 7.5 | akhilrex podgrabPodgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and… | |
| CVE-2026-104058 | 1 Oct 2026 | CVSS 5.3 | akhilrex podgrabPodgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the… | |
| CVE-2026-104059 | 1 Oct 2026 | CVSS 8.1 | lektorLektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to… | |
| CVE-2026-15911 | 1 Oct 2026 | CVSS 7.4 | confluent-kafkaConfluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS… | |
| CVE-2026-97662 | 1 Oct 2026 | CVSS 8.2 | AWS security-agent-mcp-serverAn argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat… | |
| CVE-2026-9032 | 1 Oct 2026 | CVSS 7.1 | TP-Link Systems Inc. Tapo C200 V5Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without… | |
| CVE-2026-68495 | 1 Oct 2026 | CVSS 7.5 | FasterXML jackson-dataformats-binaryThe CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property… | |
| CVE-2026-68496 | 1 Oct 2026 | CVSS 7.5 | FasterXML jackson-dataformats-binaryThe Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property… | |
| CVE-2026-73976 | 1 Oct 2026 | CVSS 7.1 | 4TUResearchData djehutydjehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject SPARQL… | |
| CVE-2026-78577 | 1 Oct 2026 | CVSS 5.3 | TP-Link Systems Inc. Tapo C200 v5Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an… | |
| CVE-2026-78578 | 1 Oct 2026 | CVSS 7.1 | TP-Link Systems Inc. Tapo C200 v5Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated… | |
| CVE-2026-56097 | 1 Oct 2026 | CVSS 6.5 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to… | |
| CVE-2026-56098 | 1 Oct 2026 | CVSS 4.3 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution… | |
| CVE-2026-12542 | 1 Oct 2026 | CVSS 7.8 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script… | Fix |
| CVE-2026-12545 | 1 Oct 2026 | CVSS 6.7 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed… | |
| CVE-2026-104018 | 1 Oct 2026 | CVSS 8.8 | Wind River Systems Inc VxWorks 7An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user… | |
| CVE-2026-103923 | 1 Oct 2026 | CVSS 2.1 | KaTeX: Existing prototype pollution can bypass trust restrictionsKaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property… | Fix |
| CVE-2026-102294 | 1 Oct 2026 | CVSS 8.5 | TP-Link System Inc. TL-WR841N v14TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is… | |
| CVE-2026-102369 | 1 Oct 2026 | CVSS 8.7 | TP-Link Systems Inc. Tapo C200 v5Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An… | |
| CVE-2026-103884 | 1 Oct 2026 | CVSS 6.5 | Red Hat Build of KeycloakA flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to… | |
| CVE-2026-103922 | 1 Oct 2026 | CVSS 9.3 | Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathCapacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS… | Fix |
| CVE-2023-54404 | 1 Oct 2026 | CVSS 7.5 | colinhacks zodZod schema-validation library contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a… | |
| CVE-2026-96659 | 1 Oct 2026 | CVSS 9.1 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information… | Fix |
| CVE-2026-96658 | 1 Oct 2026 | CVSS 8.8 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code… | Fix |
| CVE-2026-93546 | 1 Oct 2026 | CVSS 8.8 | Apache Software Foundation Apache HTTP ServerInteger overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes… | |
| CVE-2026-73637 | 1 Oct 2026 | CVSS 7.3 | Apache Software Foundation Apache HTTP ServerUse after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote… | |
| CVE-2026-73975 | 1 Oct 2026 | CVSS 8.4 | 4TUResearchData djehutydjehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary… | |
| CVE-2026-77387 | 1 Oct 2026 | CVSS 4.0 | geopy: Regular Expression Denial of Service (ReDoS) in geopy.Pointgeopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient… | Fix |
| CVE-2026-79768 | 1 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache HTTP ServerPath equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard… | |
| CVE-2026-63718 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via… | |
| CVE-2026-67171 | 1 Oct 2026 | CVSS 5.3 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal… | |
| CVE-2026-67172 | 1 Oct 2026 | CVSS 3.7 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages… | |
| CVE-2026-73636 | 1 Oct 2026 | CVSS 8.1 | Apache Software Foundation Apache HTTP ServerAuthentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a… | |
| CVE-2026-58415 | 1 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache HTTP ServerInternal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms… | |
| CVE-2026-59685 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerOut-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This issue… | |
| CVE-2026-59797 | 1 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache HTTP ServerImproper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache… | |
| CVE-2026-63045 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerImproper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms… | |
| CVE-2026-63292 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerStack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote… | |
| CVE-2026-63686 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerA NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend… | |
| CVE-2026-57941 | 1 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache HTTP ServerUse After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from… | |
| CVE-2026-56153 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerOut-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | |
| CVE-2026-56154 | 1 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache HTTP ServerUse After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from… | |
| CVE-2026-56449 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerOut-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server… | |
| CVE-2026-48005 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerMissing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an… | |
| CVE-2026-21833 | 1 Oct 2026 | CVSS 3.7 | HCL Software AIONHCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks… | |
| CVE-2026-13043 | 1 Oct 2026 | CVSS 8.8 | WatchGuard Endpoint SecurityA missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local… | Fix |
| CVE-2026-14316 | 1 Oct 2026 | CVSS 8.1 | Fortra Core Privileged Access Manager (BoKS)The revoked-key error path builds a human-readable failure reason using sprintf() into a heap buffer. The allocated buffer is too small for the final… | |
| CVE-2026-12540 | 1 Oct 2026 | CVSS 8.2 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed… | |
| CVE-2026-12541 | 1 Oct 2026 | CVSS 8.2 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails… | |
| CVE-2026-12544 | 1 Oct 2026 | CVSS 7.7 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where… | |
| CVE-2026-103921 | 1 Oct 2026 | CVSS 7.4 | GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket ExecutorGraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws… | Fix |
| CVE-2026-12405 | 1 Oct 2026 | CVSS 8.8 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API… | |
| CVE-2026-12423 | 1 Oct 2026 | CVSS 7.5 | Red Hat Satellite 6.16 for RHEL 8A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic… | |
| CVE-2026-101888 | 1 Oct 2026 | CVSS 7.2 | Codexonics Prime MoverThe Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write… | |
| CVE-2026-101889 | 1 Oct 2026 | CVSS 6.5 | Codexonics Prime MoverThe Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete… | |
| CVE-2026-101890 | 1 Oct 2026 | CVSS 5.4 | Codexonics Prime MoverThe Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary… | |
| CVE-2025-31980 | 1 Oct 2026 | CVSS 4.3 | HCL Software HCL BigFix Service ManagementHCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated… | |
| CVE-2026-9864 | 1 Oct 2026 | CVSS 4.8 | Fortra Core Privileged Access Manager (BoKS)Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during… | |
| CVE-2026-94620 | 1 Oct 2026 | CVSS 9.4 | foundation50 classroom50Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher… | |
| CVE-2026-79896 | 1 Oct 2026 | CVSS 7.5 | Fortra BoKS ManagerFortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated… | |
| CVE-2026-46729 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerNULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from… | |
| CVE-2026-47360 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove… | |
| CVE-2026-42356 | 1 Oct 2026 | CVSS 3.7 | Apache Software Foundation Apache HTTP ServerDeployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as… | |
| CVE-2026-42528 | 1 Oct 2026 | CVSS 4.3 | Apache Software Foundation Apache HTTP ServerA memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server… | |
| CVE-2026-17053 | 1 Oct 2026 | CVSS 4.4 | zephyrproject zephyrThe SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in… | |
| CVE-2026-103690 | 1 Oct 2026 | CVSS 6.3 | itsourcecode Leave Management SystemA flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php… | |
| CVE-2026-12627 | 1 Oct 2026 | CVSS 9.8 | Fortra's Core Privileged Access Manager (BoKS)Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with… | |
| CVE-2026-103505 | 1 Oct 2026 | CVSS 6.5 | aws-efs-csi-driverImproper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2… | |
| CVE-2026-101322 | 1 Oct 2026 | CVSS 8.3 | Eclipse Foundation Eclipse BaSyx AAS Web UIIn Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's… | |
| CVE-2026-97269 | 1 Oct 2026 | CVSS 6.5 | WPFunnelsUnauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions. | |
| CVE-2026-97273 | 1 Oct 2026 | CVSS 7.1 | Premmerce Wishlist for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | |
| CVE-2026-97277 | 1 Oct 2026 | CVSS 7.6 | Apps Mav Social BoostSubscriber Broken Access Control in Social Boost <= 3.6.2 versions. |
Page 128 of 168