[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102508 | 30 Sep 2026 | CVSS 9.2 | Apache Software Foundation Apache PLC4XImproper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker… | |
| CVE-2026-97196 | 30 Sep 2026 | CVSS 9.1 | Liquid Web / StellarWP GiveWPImproper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects… | |
| CVE-2026-89294 | 30 Sep 2026 | CVSS 7.5 | croixhaug Simply Schedule AppointmentsThe Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the… | |
| CVE-2026-97316 | 30 Sep 2026 | CVSS 5.8 | Unknown Broken Link NotifierThe Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing… | |
| CVE-2026-93580 | 30 Sep 2026 | CVSS 5.3 | Unknown InPost PLThe InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret… | |
| CVE-2026-94274 | 30 Sep 2026 | CVSS 5.3 | Unknown YayReviewsThe YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including… | |
| CVE-2026-94297 | 30 Sep 2026 | CVSS 2.7 | Unknown Media Library OrganizerThe Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability… | |
| CVE-2026-96886 | 30 Sep 2026 | CVSS 5.3 | Unknown Course Booking SystemThe Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download… | |
| CVE-2026-91051 | 30 Sep 2026 | CVSS 6.6 | Unknown EWWW Image OptimizerThe EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized… | |
| CVE-2026-91072 | 30 Sep 2026 | CVSS 4.4 | Unknown EWWW Image OptimizerThe EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads… | |
| CVE-2026-91832 | 30 Sep 2026 | CVSS 7.1 | Unknown WP Mobile MenuThe WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP… | |
| CVE-2026-92424 | 30 Sep 2026 | CVSS 6.8 | Unknown Content EggThe Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import… | |
| CVE-2026-92994 | 30 Sep 2026 | CVSS 8.8 | Unknown Verge3D Publishing and E-CommerceThe Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage… | |
| CVE-2026-89190 | 30 Sep 2026 | CVSS 4.3 | Unknown Robin Image OptimizerThe Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin… | |
| CVE-2026-89193 | 30 Sep 2026 | CVSS 7.5 | Unknown Robin Image OptimizerThe Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a… | |
| CVE-2026-90953 | 30 Sep 2026 | CVSS 4.3 | Unknown Image OptimizerThe Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any… | |
| CVE-2026-86789 | 30 Sep 2026 | CVSS 5.3 | Unknown Connections Business DirectoryThe Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST… | |
| CVE-2026-87777 | 30 Sep 2026 | CVSS 6.8 | Unknown Hostinger ReachThe Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing… | |
| CVE-2026-88791 | 30 Sep 2026 | CVSS 3.4 | Unknown Safe Redirect ManagerThe Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an… | |
| CVE-2026-88797 | 30 Sep 2026 | CVSS 7.1 | Unknown Vayu XThe Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every… | |
| CVE-2026-85415 | 30 Sep 2026 | CVSS 6.8 | Unknown Audio Player BlockThe Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing… | |
| CVE-2026-85573 | 30 Sep 2026 | CVSS 8.8 | Unknown All in One Files UploadThe All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify… | |
| CVE-2026-85576 | 30 Sep 2026 | CVSS 4.3 | Unknown All in One Files UploadThe All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request… | |
| CVE-2026-80333 | 30 Sep 2026 | CVSS 5.3 | Unknown Solace ExtraThe Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing… | |
| CVE-2026-82127 | 30 Sep 2026 | CVSS 3.5 | Unknown Schema & Structured Data for WP & AMPThe Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor… | |
| CVE-2026-83560 | 30 Sep 2026 | CVSS 5.3 | Unknown New User ApproveThe New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the… | |
| CVE-2026-85001 | 30 Sep 2026 | CVSS 6.8 | Unknown EmbedPressThe EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML… | |
| CVE-2026-75824 | 30 Sep 2026 | CVSS 5.3 | Unknown User FrontendThe User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing… | |
| CVE-2026-75873 | 30 Sep 2026 | CVSS 9.8 | Unknown Zella ThemeThe Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to… | |
| CVE-2026-75823 | 30 Sep 2026 | CVSS 7.4 | Unknown User FrontendThe User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated… | |
| CVE-2026-100143 | 30 Sep 2026 | CVSS 6.5 | Unknown FluentCart A New Era of eCommerceThe FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email… | |
| CVE-2026-103111 | 30 Sep 2026 | CVSS 7.6 | PCRE2PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary… | |
| CVE-2026-102913 | 30 Sep 2026 | CVSS 7.3 | SourceCodester Car Driving School Management SystemA security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file… | |
| CVE-2026-86134 | 30 Sep 2026 | CVSS 7.5 | WatchGuard Fireware OSA NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the… | Fix |
| CVE-2026-103110 | 30 Sep 2026 | CVSS 9.8 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely… | |
| CVE-2026-102911 | 30 Sep 2026 | CVSS 9.9 | zosmaai pi-llm-wikiA flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component… | |
| CVE-2026-102912 | 30 Sep 2026 | CVSS 4.7 | SourceCodester Online Leave Management SystemA vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file… | |
| CVE-2026-102910 | 30 Sep 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-103109 | 30 Sep 2026 | CVSS 9.4 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote… | |
| CVE-2026-86556 | 30 Sep 2026 | CVSS 5.3 | ZTE U30 AirThere is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability to… | |
| CVE-2026-96649 | 30 Sep 2026 | CVSS 7.2 | wpshuffle Frontend Post Submission Manager Lite – Guest Post and Frontend Submission FormsThe Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site… | |
| CVE-2026-103101 | 30 Sep 2026 | CVSS 7.5 | Pexip InfinityPexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a… | |
| CVE-2026-103102 | 30 Sep 2026 | CVSS 8.6 | Pexip InfinityPexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a… | |
| CVE-2026-103104 | 30 Sep 2026 | CVSS 7.5 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote… | |
| CVE-2026-103105 | 30 Sep 2026 | CVSS 8.8 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacker with… | |
| CVE-2026-103106 | 30 Sep 2026 | CVSS 7.8 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service that allows… | |
| CVE-2026-103108 | 30 Sep 2026 | CVSS 7.5 | Pexip InfinityPexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote… | |
| CVE-2026-102906 | 30 Sep 2026 | CVSS 6.3 | 0xshariq github-mcp-serverA vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638571801a. This issue affects the function… | |
| CVE-2026-102908 | 30 Sep 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file… | |
| CVE-2026-102909 | 30 Sep 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file… | |
| CVE-2026-103099 | 30 Sep 2026 | CVSS 7.5 | Pexip InfinityPexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software… | |
| CVE-2026-103100 | 30 Sep 2026 | CVSS 7.5 | Pexip InfinityPexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigger a… | |
| CVE-2026-102874 | 30 Sep 2026 | CVSS 7.3 | HKUDS AnyToolA vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the… | |
| CVE-2026-103087 | 30 Sep 2026 | CVSS 7.1 | gosub-io gosub-engineUncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a… | |
| CVE-2026-103088 | 30 Sep 2026 | CVSS 7.5 | jknack handlebars.javaHandlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490… | |
| CVE-2026-78229 | 30 Sep 2026 | CVSS 6.7 | PFU Limited Image Scanner Driver for Linux (fi Series)Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected… | |
| CVE-2026-81310 | 30 Sep 2026 | CVSS 6.6 | PFU Limited Image Scanner Driver for Linux (fi Series)Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed… | |
| CVE-2026-102843 | 30 Sep 2026 | CVSS 4.7 | gedelumbung HospitalManagementA security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus… | |
| CVE-2026-102844 | 30 Sep 2026 | CVSS 2.7 | gedelumbung HospitalManagementA weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the… | |
| CVE-2026-102845 | 30 Sep 2026 | CVSS 5.3 | gedelumbung HospitalManagementA security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the… | |
| CVE-2026-102846 | 30 Sep 2026 | CVSS 4.7 | gedelumbung HospitalManagementA vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function… | |
| CVE-2026-102847 | 30 Sep 2026 | CVSS 4.3 | gedelumbung HospitalManagementA flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of… | |
| CVE-2026-103056 | 30 Sep 2026 | CVSS 9.0 | beenuar AiSOCAiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response… | |
| CVE-2026-103057 | 30 Sep 2026 | CVSS 4.3 | beenuar AiSOCAiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST… | |
| CVE-2026-51936 | 30 Sep 2026 | CVSS 2.1 | Zetetic SQLCipherZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached… | |
| CVE-2026-102805 | 30 Sep 2026 | CVSS 6.5 | Nothings stbA flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the… | |
| CVE-2026-102842 | 30 Sep 2026 | CVSS 6.3 | gedelumbung HospitalManagementA vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the… | |
| CVE-2026-103053 | 30 Sep 2026 | CVSS 5.4 | beenuar AiSOCAiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and… | |
| CVE-2026-103054 | 30 Sep 2026 | CVSS 7.1 | beenuar AiSOCAiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary… | |
| CVE-2026-103055 | 30 Sep 2026 | CVSS 7.5 | beenuar AiSOCAiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the… | |
| CVE-2026-102804 | 30 Sep 2026 | CVSS 6.5 | Nothings stbA vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the… | |
| CVE-2026-86133 | 30 Sep 2026 | CVSS 7.5 | WatchGuard Fireware OSAn integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2… | Fix |
| CVE-2026-86136 | 30 Sep 2026 | CVSS 8.1 | WatchGuard Fireware OSA missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user… | Fix |
| CVE-2026-90441 | 30 Sep 2026 | CVSS 8.1 | WatchGuard Fireware OSA missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user… | Fix |
| CVE-2026-18145 | 30 Sep 2026 | CVSS 7.2 | WatchGuard Fireware OSA stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with… | Fix |
| CVE-2026-81433 | 30 Sep 2026 | CVSS 8.7 | WatchGuard Fireware OSA stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with… | |
| CVE-2026-86101 | 30 Sep 2026 | CVSS 6.5 | WatchGuard Fireware OSAn improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to… | Fix |
| CVE-2026-86104 | 30 Sep 2026 | CVSS 7.5 | WatchGuard Fireware OSAn uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a… | Fix |
| CVE-2026-86105 | 30 Sep 2026 | CVSS 7.1 | WatchGuard Fireware OSAn improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to… | Fix |
| CVE-2026-86128 | 30 Sep 2026 | CVSS 7.5 | WatchGuard Fireware OSA NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a… | Fix |
| CVE-2026-86131 | 30 Sep 2026 | CVSS 9.8 | WatchGuard Fireware OSA code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote… | Fix |
| CVE-2026-86132 | 30 Sep 2026 | CVSS 7.5 | WatchGuard Fireware OSAn integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process… | Fix |
| CVE-2026-103048 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Collection extensionURL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source… | |
| CVE-2026-103049 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo… | |
| CVE-2026-103050 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - MassMessage extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-103051 | 30 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - CentralNotice extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-13046 | 30 Sep 2026 | CVSS 7.2 | WatchGuard Fireware OSA deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has… | Fix |
| CVE-2026-13224 | 30 Sep 2026 | CVSS 4.9 | WatchGuard Fireware OSA path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the… | Fix |
| CVE-2026-18105 | 30 Sep 2026 | CVSS 6.5 | WatchGuard Fireware OSAn uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a… | Fix |
| CVE-2026-102794 | 30 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such… | |
| CVE-2026-102793 | 30 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone… | |
| CVE-2026-103043 | 29 Sep 2026 | CVSS 7.5 | alexcorvi anchormeanchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic… | |
| CVE-2026-103044 | 29 Sep 2026 | CVSS 9.8 | The Wikimedia Foundation Mediawiki - EasyTimeline extensionXML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This… | |
| CVE-2026-103045 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Refreshed skinImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed… | |
| CVE-2026-103046 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - WikiLambda ExtensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda… | |
| CVE-2026-103047 | 29 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - CentralAuth extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki -… | |
| CVE-2026-102792 | 29 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The… | |
| CVE-2026-103040 | 29 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The… | |
| CVE-2026-103041 | 29 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces… | |
| CVE-2026-103042 | 29 Sep 2026 | CVSS 7.5 | ModelTC LightLLMLightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_trans_mode nccl, allowing… |
Page 137 of 168