[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-47503 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an… | |
| CVE-2026-47504 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type… | |
| CVE-2026-47505 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause a use-after-free. A successful… | |
| CVE-2026-47506 | 30 Sep 2026 | CVSS 5.5 | NVIDIA GeForceNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel-mode color transform path where excessive kernel stack use occurs when… | |
| CVE-2026-47507 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds array… | |
| CVE-2026-47495 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds… | |
| CVE-2026-47496 | 30 Sep 2026 | CVSS 7.3 | NVIDIA Virtual GPU ManagerNVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an… | |
| CVE-2026-47497 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper… | |
| CVE-2026-47498 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by… | |
| CVE-2026-47499 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds… | |
| CVE-2026-47500 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during… | |
| CVE-2026-47501 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying… | |
| CVE-2026-47489 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A… | |
| CVE-2026-47491 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory… | |
| CVE-2026-47492 | 30 Sep 2026 | CVSS 5.5 | NVIDIA GeForceNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access… | |
| CVE-2026-47493 | 30 Sep 2026 | CVSS 7.8 | NVIDIA Virtual GPU ManagerNVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources… | |
| CVE-2026-47494 | 30 Sep 2026 | CVSS 7.8 | NVIDIA GeForceNVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this… | |
| CVE-2026-103442 | 30 Sep 2026 | CVSS 7.2 | The Wikimedia Foundation MediaWiki CentralAuth extensionExternal control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection… | |
| CVE-2026-103470 | 30 Sep 2026 | CVSS 9.3 | Internet2 GrouperIn Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate… | |
| CVE-2026-103432 | 30 Sep 2026 | CVSS 8.1 | apcupsdapcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and… | |
| CVE-2026-103436 | 30 Sep 2026 | CVSS 3.7 | apcupsdapcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and… | |
| CVE-2026-103441 | 30 Sep 2026 | CVSS 7.2 | The Wikimedia Foundation MediaWiki Wikibase extensionDeserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in… | |
| CVE-2026-103229 | 30 Sep 2026 | CVSS 7.3 | AdithyaYelloju Restaurant-Management-SystemA vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the… | |
| CVE-2026-103230 | 30 Sep 2026 | CVSS 7.3 | AdithyaYelloju Restaurant-Management-SystemA vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the… | |
| CVE-2026-103231 | 30 Sep 2026 | CVSS 7.3 | AdithyaYelloju Restaurant-Management-SystemA vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is… | |
| CVE-2026-102427 | 30 Sep 2026 | CVSS 10.0 | ordasoft.com OrdaSoft Joomla CCKJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the… | |
| CVE-2026-100275 | 30 Sep 2026 | CVSS 4.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible | |
| CVE-2026-100276 | 30 Sep 2026 | CVSS 7.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action | |
| CVE-2026-100277 | 30 Sep 2026 | CVSS 9.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature | |
| CVE-2026-100278 | 30 Sep 2026 | CVSS 4.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments | |
| CVE-2026-100279 | 30 Sep 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials | |
| CVE-2026-100280 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible | |
| CVE-2026-100268 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | |
| CVE-2026-100269 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed | |
| CVE-2026-100270 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations | |
| CVE-2026-100271 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other… | |
| CVE-2026-100272 | 30 Sep 2026 | CVSS 4.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read… | |
| CVE-2026-100273 | 30 Sep 2026 | CVSS 9.8 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution | |
| CVE-2026-100274 | 30 Sep 2026 | CVSS 6.5 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template | |
| CVE-2026-100262 | 30 Sep 2026 | CVSS 7.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification… | |
| CVE-2026-100263 | 30 Sep 2026 | CVSS 6.1 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | |
| CVE-2026-100264 | 30 Sep 2026 | CVSS 2.7 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host | |
| CVE-2026-100265 | 30 Sep 2026 | CVSS 6.5 | JetBrains RiderIn JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation | |
| CVE-2026-100266 | 30 Sep 2026 | CVSS 6.5 | JetBrains HubIn JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address | |
| CVE-2026-100267 | 30 Sep 2026 | CVSS 5.9 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters | |
| CVE-2026-100255 | 30 Sep 2026 | CVSS 9.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset | |
| CVE-2026-100256 | 30 Sep 2026 | CVSS 7.8 | JetBrains IntelliJ IDEAIn JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects | |
| CVE-2026-100257 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export | |
| CVE-2026-100258 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings | |
| CVE-2026-100259 | 30 Sep 2026 | CVSS 4.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access | |
| CVE-2026-100260 | 30 Sep 2026 | CVSS 5.3 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset | |
| CVE-2026-100261 | 30 Sep 2026 | CVSS 5.4 | JetBrains YouTrackIn JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission | |
| CVE-2026-100253 | 30 Sep 2026 | CVSS 8.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL | |
| CVE-2026-100254 | 30 Sep 2026 | CVSS 8.8 | JetBrains TeamCityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline… | |
| CVE-2026-94545 | 30 Sep 2026 | CVSS 5.3 | vercel satoriSatori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain… | |
| CVE-2026-97259 | 30 Sep 2026 | CVSS 5.3 | WP Hosting AS Pay with Vipps for WooCommerceAuthorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly… | |
| CVE-2026-76570 | 30 Sep 2026 | CVSS 9.1 | joomcode.com JCTables extension for JoomlaJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller… | |
| CVE-2026-62084 | 30 Sep 2026 | CVSS 6.5 | Jeff Starr User Submitted PostsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored… | |
| CVE-2026-62097 | 30 Sep 2026 | CVSS 7.6 | WPTasty Business DirectoryImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory… | |
| CVE-2026-18782 | 30 Sep 2026 | CVSS 9.8 | Trex Digital Smart Manufacturing Systems Inc. Trex MESImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc… | |
| CVE-2026-18783 | 30 Sep 2026 | CVSS 8.8 | Trex Digital Smart Manufacturing Systems Inc. Trex MESMissing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass… | |
| CVE-2026-47097 | 30 Sep 2026 | CVSS 7.5 | AJA Video Systems HELO PlusAJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive… | |
| CVE-2026-103396 | 30 Sep 2026 | CVSS 4.3 | mlogclub bbs-gobbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view… | |
| CVE-2026-103397 | 30 Sep 2026 | CVSS 5.6 | Liquid-co OpenSaveOpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by… | |
| CVE-2026-103398 | 30 Sep 2026 | CVSS 8.1 | Liquid-co OpenSaveOpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify… | |
| CVE-2026-103388 | 30 Sep 2026 | CVSS 6.2 | MISPMISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation… | |
| CVE-2026-103389 | 30 Sep 2026 | CVSS 6.2 | MISPMISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted… | |
| CVE-2026-103395 | 30 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied… | |
| CVE-2026-103227 | 30 Sep 2026 | CVSS 6.3 | GPACA weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file… | |
| CVE-2026-103243 | 30 Sep 2026 | CVSS 5.8 | ModelTC LightLLMLightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform… | |
| CVE-2026-103270 | 30 Sep 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers… | |
| CVE-2026-103222 | 30 Sep 2026 | CVSS 5.6 | Blosc C-Blosc2A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the… | |
| CVE-2026-103226 | 30 Sep 2026 | CVSS 6.3 | Artifex GhostscriptA vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdevpsfx.c of… | |
| CVE-2026-102984 | 30 Sep 2026 | CVSS 8.2 | Astro: Malformed port in the Host header can crash the Node adapterAstro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a… | Fix |
| CVE-2026-102983 | 30 Sep 2026 | CVSS 6.3 | Astro: Netlify Image CDN allowlist bypass enables SSRFAstro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify… | Fix |
| CVE-2026-102717 | 30 Sep 2026 | CVSS 7.5 | Eclipse Foundation NetX DuoMQTT WebSocket setter ABI mismatch may disclose memory or cause a crash | |
| CVE-2026-101295 | 30 Sep 2026 | CVSS 7.3 | Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1… | |
| CVE-2026-93903 | 30 Sep 2026 | CVSS 9.4 | litespeedtech LiteSpeed Web ServerLiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | |
| CVE-2026-91860 | 30 Sep 2026 | CVSS 6.3 | vaadinA prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application… | |
| CVE-2026-93547 | 30 Sep 2026 | CVSS 5.3 | vaadinA missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or… | |
| CVE-2026-82307 | 30 Sep 2026 | CVSS 9.8 | Dolusoft Software Technologies SOPLOGImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows… | |
| CVE-2026-103118 | 30 Sep 2026 | CVSS 4.3 | GraphicsMagickA vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file… | |
| CVE-2026-97302 | 30 Sep 2026 | CVSS 5.3 | Themeisle MPGUnauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. | |
| CVE-2026-97288 | 30 Sep 2026 | CVSS 6.5 | Jayson T Cote OAuth ServerContributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. | |
| CVE-2026-97289 | 30 Sep 2026 | CVSS 7.1 | ExpressTech Quiz And Survey MasterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master… | |
| CVE-2026-97292 | 30 Sep 2026 | CVSS 6.5 | YITHEMES YITH WooCommerce Tab ManagerAuthor Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | |
| CVE-2026-97293 | 30 Sep 2026 | CVSS 8.5 | David Lingren Media LIbrary AssistantContributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. | |
| CVE-2026-97298 | 30 Sep 2026 | CVSS 6.5 | KingAddons King Addons for ElementorContributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | |
| CVE-2026-97299 | 30 Sep 2026 | CVSS 5.4 | KnitPay Razorpay Payment Links for WooCommerceUnauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. | |
| CVE-2026-97301 | 30 Sep 2026 | CVSS 6.5 | Cool Plugins Cool Formkit LiteContributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | |
| CVE-2026-97271 | 30 Sep 2026 | CVSS 7.1 | WPFunnelsUnauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | |
| CVE-2026-97272 | 30 Sep 2026 | CVSS 7.1 | Premmerce Permalink Manager for WooCommerceUnauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. | |
| CVE-2026-97274 | 30 Sep 2026 | CVSS 9.8 | miniOrange OAuth Single Sign On – SSO (OAuth Client)Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. | |
| CVE-2026-97279 | 30 Sep 2026 | CVSS 6.5 | Chouby PolylangContributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. | |
| CVE-2026-97282 | 30 Sep 2026 | CVSS 5.3 | RadiusTheme Review SchemaUnauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions. | |
| CVE-2026-97285 | 30 Sep 2026 | CVSS 5.4 | Nexcess The Events CalendarContributor Broken Access Control in The Events Calendar <= 6.17.5 versions. | |
| CVE-2026-97286 | 30 Sep 2026 | CVSS 6.5 | WP Chill Strong TestimonialsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials… | |
| CVE-2026-97287 | 30 Sep 2026 | CVSS 8.5 | Liquid Web / StellarWP Event TicketsImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets… | |
| CVE-2026-97250 | 30 Sep 2026 | CVSS 7.1 | Dylan Kuhn Geo MashupUnauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. | |
| CVE-2026-97253 | 30 Sep 2026 | CVSS 7.1 | Kreatura LayerSliderImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This… |
Page 134 of 168