[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102124 | 30 Sep 2026 | CVSS 6.5 | Kiteworks CoreA Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated… | |
| CVE-2026-102125 | 30 Sep 2026 | CVSS 8.8 | Kiteworks CoreThe sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already executing… | |
| CVE-2026-102126 | 30 Sep 2026 | CVSS 8.1 | Kiteworks CoreA stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated… | |
| CVE-2026-102115 | 30 Sep 2026 | CVSS 9.8 | Kiteworks CoreKiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email… | |
| CVE-2026-102116 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection Gateway-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and… | |
| CVE-2026-102117 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreOn deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key… | |
| CVE-2026-102118 | 30 Sep 2026 | CVSS 7.8 | Kiteworks CoreA local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account… | |
| CVE-2026-102119 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayA path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended… | |
| CVE-2026-102111 | 30 Sep 2026 | CVSS 4.9 | Kiteworks CoreKiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value… | |
| CVE-2026-102112 | 30 Sep 2026 | CVSS 7.8 | Kiteworks CoreA privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service… | |
| CVE-2026-102113 | 30 Sep 2026 | CVSS 7.8 | Kiteworks CoreA privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service… | |
| CVE-2026-102114 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreA command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-system… | |
| CVE-2026-102102 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF)… | |
| CVE-2026-102103 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF)… | |
| CVE-2026-102104 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF)… | |
| CVE-2026-102105 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery (SSRF). A server-side request forgery (SSRF)… | |
| CVE-2026-102106 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayImproper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection… | |
| CVE-2026-102107 | 30 Sep 2026 | CVSS 4.6 | Kiteworks CoreKiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to… | |
| CVE-2026-102108 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayAn authenticated administrator of Kiteworks Email Protection Gateway could submit a crafted serialized object to a cluster management interface that… | |
| CVE-2026-102109 | 30 Sep 2026 | CVSS 7.1 | Kiteworks Secure Data FormsA SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was… | |
| CVE-2026-102110 | 30 Sep 2026 | CVSS 5.9 | Kiteworks CoreAn endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so… | |
| CVE-2026-102095 | 30 Sep 2026 | CVSS 9.1 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed… | |
| CVE-2026-102096 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration… | |
| CVE-2026-102097 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Remote Code Execution. Kiteworks Email Protection Gateway allowed an… | |
| CVE-2026-102098 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting… | |
| CVE-2026-102099 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kiteworks… | |
| CVE-2026-102100 | 30 Sep 2026 | CVSS 8.7 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core… | |
| CVE-2026-102101 | 30 Sep 2026 | CVSS 8.1 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could, under… | |
| CVE-2026-102089 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an… | |
| CVE-2026-102090 | 30 Sep 2026 | CVSS 4.3 | Kiteworks CoreKiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an… | |
| CVE-2026-102091 | 30 Sep 2026 | CVSS 7.5 | Kiteworks Secure Data FormsKiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to… | |
| CVE-2026-102092 | 30 Sep 2026 | CVSS 8.7 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted… | |
| CVE-2026-102093 | 30 Sep 2026 | CVSS 7.2 | Kiteworks CoreKiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment… | |
| CVE-2026-102094 | 30 Sep 2026 | CVSS 7.2 | Kiteworks Email Protection GatewayKiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the… | |
| CVE-2026-101276 | 30 Sep 2026 | CVSS 9.2 | esnet iperf3iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees streams… | |
| CVE-2023-54403 | 30 Sep 2026 | CVSS 7.5 | Yonyou U8 CRMYonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to… | |
| CVE-2024-58387 | 30 Sep 2026 | CVSS 7.5 | Inspur Haiyue HCM CloudInspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/model_report/file/download endpoint that allows unauthenticated… | |
| CVE-2023-54402 | 30 Sep 2026 | CVSS 7.5 | iDocViewiDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch… | |
| CVE-2026-103547 | 30 Sep 2026 | CVSS 9.2 | OpenBSDIn ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child… | |
| CVE-2026-103548 | 30 Sep 2026 | CVSS 5.3 | Itron MV-90 xiImproperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access… | |
| CVE-2026-103387 | 30 Sep 2026 | CVSS 4.3 | garycourt uri-jsA weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the… | |
| CVE-2026-102994 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible long runtimes/large memory usage when parsing indirect objectspypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number… | Fix |
| CVE-2026-102992 | 30 Sep 2026 | CVSS 9.2 | piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envpiscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain… | Fix |
| CVE-2026-102993 | 30 Sep 2026 | CVSS 7.5 | pypdf: Possible large memory usage when retrieving Roman page labelspypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that… | Fix |
| CVE-2026-102990 | 30 Sep 2026 | CVSS 8.2 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU… | Fix |
| CVE-2026-102991 | 30 Sep 2026 | CVSS 6.5 | Mako: Path traversal via drive-letter URI on Windows in TemplateLookupMako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with… | Fix |
| CVE-2026-101885 | 30 Sep 2026 | CVSS 7.8 | zeroclaw-labs ZeroClawZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate… | |
| CVE-2026-101883 | 30 Sep 2026 | CVSS 5.4 | OpenClaw Windows NodeOpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk… | |
| CVE-2026-101884 | 30 Sep 2026 | CVSS 7.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*… | |
| CVE-2026-101881 | 30 Sep 2026 | CVSS 6.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows… | |
| CVE-2026-101882 | 30 Sep 2026 | CVSS 8.8 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable… | |
| CVE-2026-101879 | 30 Sep 2026 | CVSS 6.5 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways… | |
| CVE-2026-101880 | 30 Sep 2026 | CVSS 8.8 | OpenClaw Windows NodeOpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where… | |
| CVE-2026-97256 | 30 Sep 2026 | CVSS 7.2 | Greg – SiteOrigin Page Builder by SiteOriginEditor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. | |
| CVE-2026-97265 | 30 Sep 2026 | CVSS 6.5 | Crocoblock. Jetimpex Inc. JetEngineImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows… | |
| CVE-2026-97290 | 30 Sep 2026 | CVSS 7.1 | Sayontan Sinha Photonic Gallery & Lightbox for Flickr, SmugMug & OthersUnauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions. | |
| CVE-2026-97291 | 30 Sep 2026 | CVSS 8.8 | Magazine3 Schema & Structured Data for WP & AMPContributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions. | |
| CVE-2026-94171 | 30 Sep 2026 | CVSS 7.1 | VillaTheme CURCYImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows… | |
| CVE-2026-87004 | 30 Sep 2026 | CVSS 8.1 | Quenary tugtainerTugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes… | |
| CVE-2026-53605 | 30 Sep 2026 | CVSS 7.8 | pollen-robotics reachy-mini-osReachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen… | |
| CVE-2026-55094 | 30 Sep 2026 | CVSS 8.7 | taskclusterTaskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0… | |
| CVE-2026-55107 | 30 Sep 2026 | CVSS 10.0 | elct9620 kobakoKobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated… | |
| CVE-2026-55224 | 30 Sep 2026 | CVSS 8.7 | MineAdminMineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers… | |
| CVE-2026-103500 | 30 Sep 2026 | CVSS 6.1 | Mozilla ThunderbirdAn attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability… | |
| CVE-2026-103446 | 30 Sep 2026 | CVSS 7.4 | The Wikimedia Foundation MediaWiki WikiLambda extensionAuthorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication… | |
| CVE-2026-103471 | 30 Sep 2026 | CVSS 7.5 | Corvusoft restbedrestbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust… | |
| CVE-2026-103472 | 30 Sep 2026 | CVSS 7.5 | Corvusoft restbedrestbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an… | |
| CVE-2026-103473 | 30 Sep 2026 | CVSS 8.1 | denoland denoDeno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for… | |
| CVE-2026-103474 | 30 Sep 2026 | CVSS 8.8 | yii2-starter-kityii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP… | |
| CVE-2026-103475 | 30 Sep 2026 | CVSS 9.1 | yii2-starter-kityii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development… | |
| CVE-2026-103476 | 30 Sep 2026 | CVSS 5.3 | yii2-starter-kityii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers… | |
| CVE-2026-103399 | 30 Sep 2026 | CVSS 5.3 | Red Hat Enterprise Linux 10A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer… | |
| CVE-2026-103437 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki ReadingLists extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists… | |
| CVE-2026-103438 | 30 Sep 2026 | CVSS 0.3 | The Wikimedia Foundation MediaWiki Wikistories extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories… | |
| CVE-2026-103439 | 30 Sep 2026 | CVSS 0.3 | The Wikimedia Foundation MediaWiki Wikbase extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension… | |
| CVE-2026-103440 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki PageTriage extensionExposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information… | |
| CVE-2026-103445 | 30 Sep 2026 | CVSS 1.2 | The Wikimedia Foundation MediaWiki Page_Forms extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms… | |
| CVE-2026-102375 | 30 Sep 2026 | CVSS 6.5 | OptimoleMissing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-102376 | 30 Sep 2026 | CVSS 7.1 | WPMU DEV BrandaSubscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions. | |
| CVE-2026-102377 | 30 Sep 2026 | CVSS 8.8 | 10Web Photo Gallery by 10WebContributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. | |
| CVE-2026-102391 | 30 Sep 2026 | CVSS 7.1 | jetmonsters JetFormBuilderUnauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. | |
| CVE-2026-102392 | 30 Sep 2026 | CVSS 7.2 | ThemeHigh Extra Product Options For WooCommerce | Custom Product Addons and FieldsShop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions. | |
| CVE-2026-102397 | 30 Sep 2026 | CVSS 6.5 | supsystic Ultimate Maps by SupsysticUnauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions. | |
| CVE-2026-100510 | 30 Sep 2026 | CVSS 7.1 | BoldGrid Post and Page Builder by BoldGridUnauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions. | |
| CVE-2026-100512 | 30 Sep 2026 | CVSS 9.8 | Hook & Filter Nested PagesContributor PHP Object Injection in Nested Pages <= 3.3.2 versions. | |
| CVE-2026-62308 | 30 Sep 2026 | CVSS 9.1 | Quenary tugtainerTugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user to make… | |
| CVE-2026-75969 | 30 Sep 2026 | CVSS 9.1 | PTZOptics Move 4K 12XMissing authentication for critical function vulnerability for all PTZOptics cameras and the Firmware Upgrade Tool - Firmware Update modules. A… | |
| CVE-2026-55494 | 30 Sep 2026 | CVSS 9.8 | Quenary tugtainerTugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to… | |
| CVE-2026-46711 | 30 Sep 2026 | CVSS 8.3 | Soft-Machine-io securitySoft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that… | |
| CVE-2026-55176 | 30 Sep 2026 | CVSS 9.0 | Soft-Machine-io securitySoft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in… | |
| CVE-2026-55177 | 30 Sep 2026 | CVSS 7.6 | dfpc-coe CloudTAKCloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the… | |
| CVE-2026-55181 | 30 Sep 2026 | CVSS 9.4 | Quenary tugtainerTugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be… | |
| CVE-2026-19445 | 30 Sep 2026 | CVSS 9.2 | Python Software Foundation CPythonA remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to… | Fix |
| CVE-2026-19553 | 30 Sep 2026 | CVSS 7.6 | Python Software Foundation CPythonssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing… | Fix |
| CVE-2026-103443 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki Collection (Book) extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book)… | |
| CVE-2026-103444 | 30 Sep 2026 | CVSS 1.1 | The Wikimedia Foundation MediaWiki WikiForum extensionImproper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension… | |
| CVE-2026-103232 | 30 Sep 2026 | CVSS 7.3 | AdithyaYelloju Restaurant-Management-SystemA weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the… | |
| CVE-2026-103233 | 30 Sep 2026 | CVSS 6.3 | AdithyaYelloju Restaurant-Management-SystemA security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This… | |
| CVE-2026-103241 | 30 Sep 2026 | CVSS 7.5 | vllm-project vLLMA flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of… | Fix |
| CVE-2026-102489 | 30 Sep 2026 | CVSS 9.8 | Session hijack leads to code execution in ZammadZammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also… | Exploited |
Page 132 of 168