[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-103264 | 1 Oct 2026 | CVSS 9.1 | fleetdm fleetFleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as… | |
| CVE-2026-103265 | 1 Oct 2026 | CVSS 4.3 | fleetdm fleetFleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users… | |
| CVE-2026-103266 | 1 Oct 2026 | CVSS 7.1 | TryGhost GhostGhost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a… | |
| CVE-2026-103267 | 1 Oct 2026 | CVSS 4.3 | TryGhost GhostGhost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address… | |
| CVE-2026-103257 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that… | |
| CVE-2026-103258 | 1 Oct 2026 | CVSS 6.8 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and… | |
| CVE-2026-103259 | 1 Oct 2026 | CVSS 7.6 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke… | |
| CVE-2026-103260 | 1 Oct 2026 | CVSS 4.0 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode… | |
| CVE-2026-103261 | 1 Oct 2026 | CVSS 5.3 | tornadoweb tornadoTornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop… | |
| CVE-2026-103252 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential… | |
| CVE-2026-103253 | 1 Oct 2026 | CVSS 8.7 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database… | |
| CVE-2026-103254 | 1 Oct 2026 | CVSS 6.3 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL… | |
| CVE-2026-103255 | 1 Oct 2026 | CVSS 9.0 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node… | |
| CVE-2026-103256 | 1 Oct 2026 | CVSS 7.1 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password… | |
| CVE-2026-103247 | 1 Oct 2026 | CVSS 8.5 | n8n-io n8nn8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard… | |
| CVE-2026-103248 | 1 Oct 2026 | CVSS 9.0 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's… | |
| CVE-2026-103249 | 1 Oct 2026 | CVSS 7.6 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in… | |
| CVE-2026-103250 | 1 Oct 2026 | CVSS 8.1 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB Chat… | |
| CVE-2026-103251 | 1 Oct 2026 | CVSS 7.1 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community… | |
| CVE-2026-103082 | 1 Oct 2026 | CVSS 7.2 | LA-Studio Element Kit for ElementorServer-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Request… | |
| CVE-2026-103244 | 1 Oct 2026 | CVSS 9.8 | sgoudelis ground-stationground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated… | |
| CVE-2026-103245 | 1 Oct 2026 | CVSS 5.3 | n8n-io n8nn8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow… | |
| CVE-2026-103246 | 1 Oct 2026 | CVSS 7.7 | n8n-io n8nn8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can… | |
| CVE-2026-7176 | 1 Oct 2026 | CVSS 4.8 | Crocantickets EntradiumCVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating… | |
| CVE-2026-83589 | 1 Oct 2026 | CVSS 6.1 | Red Hat OpenShift Container Platform 4.18A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection… | |
| CVE-2026-92144 | 1 Oct 2026 | CVSS 7.2 | wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form BuilderThe Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-96256 | 1 Oct 2026 | CVSS 6.4 | wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & PatternsThe Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-96577 | 1 Oct 2026 | CVSS 7.1 | Red Hat OpenShift Container Platform 4.18A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication… | |
| CVE-2026-64948 | 1 Oct 2026 | CVSS 7.1 | Pandora FMSMissing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards. | |
| CVE-2026-64949 | 1 Oct 2026 | CVSS 8.6 | Pandora FMSIncomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS… | |
| CVE-2026-64950 | 1 Oct 2026 | CVSS 8.4 | Pandora FMSMissing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without… | |
| CVE-2026-75786 | 1 Oct 2026 | CVSS 7.2 | Pandora FMSUnsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS… | |
| CVE-2026-7173 | 1 Oct 2026 | CVSS 4.8 | Crocantickets EntradiumCVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to… | |
| CVE-2026-7174 | 1 Oct 2026 | CVSS 4.8 | Crocantickets EntradiumCVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the… | |
| CVE-2026-7175 | 1 Oct 2026 | CVSS 4.8 | Crocantickets EntradiumCVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the… | |
| CVE-2026-103495 | 1 Oct 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | |
| CVE-2026-103496 | 1 Oct 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | |
| CVE-2026-103497 | 1 Oct 2026 | CVSS 5.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | |
| CVE-2026-34189 | 1 Oct 2026 | CVSS 5.9 | Pandora FMSCross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated… | |
| CVE-2026-34190 | 1 Oct 2026 | CVSS 5.9 | Pandora FMSCross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an… | |
| CVE-2026-64946 | 1 Oct 2026 | CVSS 7.4 | Pandora FMSA chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie… | |
| CVE-2026-64947 | 1 Oct 2026 | CVSS 7.5 | Pandora FMSA chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP… | |
| CVE-2026-103489 | 1 Oct 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | |
| CVE-2026-103490 | 1 Oct 2026 | CVSS 7.2 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | |
| CVE-2026-103491 | 1 Oct 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | |
| CVE-2026-103492 | 1 Oct 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | |
| CVE-2026-103493 | 1 Oct 2026 | CVSS 8.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible | |
| CVE-2026-103494 | 1 Oct 2026 | CVSS 6.6 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes | |
| CVE-2026-103488 | 1 Oct 2026 | CVSS 7.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted… | |
| CVE-2026-97661 | 1 Oct 2026 | CVSS 7.2 | scottpaterson Business Essentials for Contact Form 7The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions… | |
| CVE-2026-92244 | 1 Oct 2026 | CVSS 7.2 | wpovernight PDF Invoices & Packing Slips for WooCommerceThe PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name… | |
| CVE-2026-95687 | 1 Oct 2026 | CVSS 8.8 | wpclever WPC Shop as a Customer for WooCommerceThe WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and… | |
| CVE-2026-96268 | 1 Oct 2026 | CVSS 6.4 | awesomesupport Awesome Support – WordPress HelpDesk & Support PluginThe Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data'… | |
| CVE-2026-96573 | 1 Oct 2026 | CVSS 7.2 | codepeople Appointment Hour Booking – Booking CalendarThe Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form… | |
| CVE-2026-96813 | 1 Oct 2026 | CVSS 7.2 | 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form BuilderThe Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark… | |
| CVE-2026-15983 | 1 Oct 2026 | CVSS 8.1 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and… | |
| CVE-2026-85235 | 1 Oct 2026 | CVSS 7.2 | wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form BuilderThe Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-89424 | 1 Oct 2026 | CVSS 6.4 | inisev Duplicate PostThe Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, and… | |
| CVE-2026-89427 | 1 Oct 2026 | CVSS 6.1 | spacetime Ad Inserter – Ad Manager & AdSense AdsThe Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all… | |
| CVE-2026-90992 | 1 Oct 2026 | CVSS 6.4 | davidanderson Redux FrameworkThe Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all… | |
| CVE-2026-103659 | 1 Oct 2026 | CVSS 7.1 | MISPMISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application… | |
| CVE-2026-103662 | 1 Oct 2026 | CVSS 5.1 | MISPMISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and disable… | |
| CVE-2026-103664 | 1 Oct 2026 | CVSS 4.8 | MISPMISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via… | |
| CVE-2026-14995 | 1 Oct 2026 | CVSS 7.2 | optimizingmatters AutoptimizeThe Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1… | |
| CVE-2026-100184 | 1 Oct 2026 | CVSS 4.7 | codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & MoreThe Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected… | |
| CVE-2026-101925 | 1 Oct 2026 | CVSS 6.4 | robin-w bbp style packThe bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (via /wp-admin/profile.php) +… | |
| CVE-2026-103431 | 1 Oct 2026 | CVSS 7.7 | Vulnerabilitycolmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before… | |
| CVE-2026-103655 | 1 Oct 2026 | CVSS 9.3 | MISPMISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more… | |
| CVE-2026-100179 | 1 Oct 2026 | CVSS 6.1 | codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & MoreThe Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected… | |
| CVE-2026-89047 | 1 Oct 2026 | CVSS 6.1 | inisev Social Media Share Buttons & Social Sharing IconsThe Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up… | |
| CVE-2026-93882 | 1 Oct 2026 | CVSS 7.5 | thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesThe LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in… | |
| CVE-2026-75957 | 1 Oct 2026 | CVSS 9.8 | superdav42 Ultimate Multisite – WordPress Multisite SaaS & WaaS PlatformThe Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to… | |
| CVE-2026-78249 | 1 Oct 2026 | CVSS 6.8 | Fujifilm Business Innovation Corp. Apeos 3060 / 2560 / 1860 Japan modelA path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and… | |
| CVE-2026-103651 | 1 Oct 2026 | CVSS 7.6 | MISPMISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of… | |
| CVE-2026-15989 | 1 Oct 2026 | CVSS 9.8 | WebRehab Super Forms – Drag & Drop Form BuilderThe Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316… | |
| CVE-2026-19807 | 1 Oct 2026 | CVSS 8.8 | ByteCoreStack – MCP Connector for AI ToolsThe ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3… | |
| CVE-2026-19902 | 1 Oct 2026 | CVSS 6.1 | spacetime Ad Inserter – Ad Manager & AdSense AdsThe Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all… | |
| CVE-2026-103544 | 1 Oct 2026 | CVSS 6.3 | datadrivenconstruction OpenConstructionERPA vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file… | |
| CVE-2025-41753 | 1 Oct 2026 | CVSS 9.8 | WAGO 0751-9x01The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are… | |
| CVE-2026-96200 | 1 Oct 2026 | CVSS 5.3 | Unknown Payments for HubtelThe Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the… | |
| CVE-2026-96255 | 1 Oct 2026 | CVSS 7.5 | Unknown Payments for HubtelThe Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including… | |
| CVE-2026-90974 | 1 Oct 2026 | CVSS 6.5 | Unknown WP Fusion LiteThe WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization… | |
| CVE-2026-92412 | 1 Oct 2026 | CVSS 7.1 | Unknown Five Star Restaurant ReviewsThe Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag… | |
| CVE-2026-96173 | 1 Oct 2026 | CVSS 5.3 | Unknown Payments for HubtelThe Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public… | |
| CVE-2026-89296 | 1 Oct 2026 | CVSS 8.6 | Unknown Pro Like ButtonThe Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing… | |
| CVE-2026-90972 | 1 Oct 2026 | CVSS 5.4 | Unknown WP Fusion LiteThe WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authenticated… | |
| CVE-2026-87973 | 1 Oct 2026 | CVSS 3.1 | Unknown If-So Dynamic ContentThe If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering the… | |
| CVE-2026-88999 | 1 Oct 2026 | CVSS 4.3 | davidanderson Redux FrameworkThe Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin… | |
| CVE-2026-86610 | 1 Oct 2026 | CVSS 6.4 | Unknown Download ManagerThe Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page… | |
| CVE-2026-87970 | 1 Oct 2026 | CVSS 4.7 | Unknown If-So Dynamic ContentThe If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX… | |
| CVE-2026-81809 | 1 Oct 2026 | CVSS 7.5 | Unknown Paytm Payment GatewayThe Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL… | |
| CVE-2026-85679 | 1 Oct 2026 | CVSS 7.2 | ExtendifyThe Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'styles.blocks' Block Type Key in all versions up to, and… | |
| CVE-2026-80276 | 1 Oct 2026 | CVSS 7.5 | Comelit Group S.p.A. 1456B Multi-User GatewayComelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does… | |
| CVE-2026-81739 | 1 Oct 2026 | CVSS 7.5 | Unknown Paytm Payment GatewayThe Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an… | |
| CVE-2026-80275 | 1 Oct 2026 | CVSS 8.8 | Comelit Group S.p.A. 1456B Multi-User GatewayComelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an… | |
| CVE-2026-19253 | 1 Oct 2026 | CVSS 8.7 | Unknown Cache EnablerThe Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and… | |
| CVE-2026-67075 | 1 Oct 2026 | CVSS 6.5 | HCLSoftware Digital ExperienceHCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from… | |
| CVE-2026-103543 | 1 Oct 2026 | CVSS 6.3 | itsourcecode Leave Management SystemA vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-103542 | 1 Oct 2026 | CVSS 4.3 | formtools.org Form ToolsA flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of the… | |
| CVE-2026-103541 | 1 Oct 2026 | CVSS 6.3 | formtools.org Form ToolsA vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file… |
Page 130 of 168