[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-90917 | 29 Sep 2026 | CVSS 5.3 | Joomla! Project Joomla! CMSJoomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - An improper access check… | Fix |
| CVE-2026-90918 | 29 Sep 2026 | CVSS 5.3 | Joomla! Project Joomla! CMSJoomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping… | Fix |
| CVE-2026-90906 | 29 Sep 2026 | CVSS 8.3 | Joomla! Project Joomla! CMSJoomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the… | Fix |
| CVE-2026-102697 | 29 Sep 2026 | CVSS 7.8 | ollamaOllama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism… | |
| CVE-2026-102796 | 29 Sep 2026 | CVSS 7.5 | Wikimedia Foundation Mediawiki - UserPageViewTracker ExtensionImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki -… | |
| CVE-2026-102634 | 29 Sep 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV… | |
| CVE-2026-102635 | 29 Sep 2026 | CVSS 5.3 | ImageMagickImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in… | Fix |
| CVE-2026-102673 | 29 Sep 2026 | CVSS 6.1 | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0, popups… | Fix |
| CVE-2026-102674 | 29 Sep 2026 | CVSS 6.1 | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |
| CVE-2026-102675 | 29 Sep 2026 | CVSS 7.4 | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |
| CVE-2026-102676 | 29 Sep 2026 | CVSS 9.8 | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and… | Fix |
| CVE-2026-102424 | 29 Sep 2026 | CVSS 7.5 | balbooa.com Balbooa Forms extension for JoomlaJoomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 -… | |
| CVE-2026-102425 | 29 Sep 2026 | CVSS 10.0 | balbooa.com Balbooa Forms extension for JoomlaJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports… | |
| CVE-2026-102556 | 29 Sep 2026 | CVSS 8.6 | Red Hat Enterprise Linux 10A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray… | |
| CVE-2026-102557 | 29 Sep 2026 | CVSS 8.6 | Red Hat Enterprise Linux 10A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size… | |
| CVE-2026-102623 | 29 Sep 2026 | CVSS 6.5 | Red Hat OpenShift Virtualization 4A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by… | |
| CVE-2026-102633 | 29 Sep 2026 | CVSS 5.9 | libexpatlibexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing… | |
| CVE-2026-101126 | 29 Sep 2026 | CVSS 6.5 | balbooa.com Balbooa Forms extension for JoomlaJoomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload… | |
| CVE-2026-101127 | 29 Sep 2026 | CVSS 9.4 | balbooa.com Balbooa Forms extension for JoomlaJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates… | |
| CVE-2026-101112 | 29 Sep 2026 | CVSS 5.3 | balbooa.com Balbooa Forms extension for JoomlaJoomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an… | |
| CVE-2026-100240 | 29 Sep 2026 | CVSS 9.1 | Wikimedia Foundation Mediawiki - TemplateSandbox ExtensionMissing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly… | |
| CVE-2026-100241 | 29 Sep 2026 | CVSS 7.5 | Wikimedia Foundation Mediawiki - EventBus ExtensionExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation… | |
| CVE-2026-100242 | 29 Sep 2026 | CVSS 7.5 | Wikimedia Foundation Mediawiki - DataTransfer ExtensionDependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer… | |
| CVE-2026-100243 | 29 Sep 2026 | CVSS 6.1 | Wikimedia Foundation Mediawiki - WikiSEO ExtensionImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiSEO… | |
| CVE-2026-100244 | 29 Sep 2026 | CVSS 7.5 | Wikimedia Foundation Mediawiki - CentralAuth ExtensionExposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation… | |
| CVE-2026-100245 | 29 Sep 2026 | CVSS 6.1 | Wikimedia Foundation Mediawiki - Wikibase ExtensionImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki -… | |
| CVE-2022-51019 | 29 Sep 2026 | CVSS 8.8 | akauntingAkaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed… | |
| CVE-2026-100238 | 29 Sep 2026 | CVSS 6.1 | Wikimedia Foundation Mediawiki - Flow ExtensionImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow… | |
| CVE-2026-97711 | 29 Sep 2026 | CVSS 2.3 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesSerialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2… | Fix |
| CVE-2026-97687 | 29 Sep 2026 | CVSS 8.1 | urllib3: HTTPS proxy TLS configuration may be ignored or overriddenurllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint… | Fix |
| CVE-2026-97688 | 29 Sep 2026 | CVSS 5.3 | urllib3: Chunked Deflate streaming can enter an infinite loopurllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop… | Fix |
| CVE-2026-97689 | 29 Sep 2026 | CVSS 7.5 | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryurllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate… | Fix |
| CVE-2026-92370 | 29 Sep 2026 | CVSS 8.8 | TeamViewer Full ClientAn improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an… | |
| CVE-2026-92371 | 29 Sep 2026 | CVSS 7.0 | TeamViewer Full ClientTeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR)… | |
| CVE-2026-93330 | 29 Sep 2026 | CVSS 4.3 | Devolutions ServerImproper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the… | |
| CVE-2026-93332 | 29 Sep 2026 | CVSS 5.4 | Devolutions ServerImproper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to… | |
| CVE-2026-92368 | 29 Sep 2026 | CVSS 7.8 | TeamViewer Full ClientTeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs… | |
| CVE-2026-92369 | 29 Sep 2026 | CVSS 7.3 | TeamViewer Full ClientTeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local… | |
| CVE-2026-84782 | 29 Sep 2026 | CVSS 8.2 | OpenSSLIssue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The… | Fix |
| CVE-2026-84783 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension data to be freed while… | Fix |
| CVE-2026-84784 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit check on how many connection… | Fix |
| CVE-2026-75805 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may dereference a NULL pointer and terminate… | Fix |
| CVE-2026-75806 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted… | Fix |
| CVE-2026-77177 | 29 Sep 2026 | CVSS 9.8 | VulnerabilityOpen GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt… | |
| CVE-2026-77696 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An… | Fix |
| CVE-2026-75804 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit… | Fix |
| CVE-2026-72897 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory… | Fix |
| CVE-2026-54872 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated… | Fix |
| CVE-2026-54873 | 29 Sep 2026 | CVSS 7.5 | OpenSSLIssue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summary: Remote peer can exploit… | Fix |
| CVE-2026-54875 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V… | Fix |
| CVE-2026-19743 | 29 Sep 2026 | CVSS 7.8 | TeamViewer Full ClientImproper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a… | |
| CVE-2026-35189 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509… | Fix |
| CVE-2026-35191 | 29 Sep 2026 | CVSS 3.7 | OpenSSLIssue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in… | Fix |
| CVE-2026-42772 | 29 Sep 2026 | CVSS 5.3 | OpenSSLIssue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a… | Fix |
| CVE-2026-102598 | 29 Sep 2026 | CVSS 6.3 | Werkzeug safe_join() allows Windows special device namesWerkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL… | Fix |
| CVE-2026-102600 | 29 Sep 2026 | CVSS 7.5 | Socket.IO: Prototype Pollution via Unsafe Client Session LookupSocket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object… | Fix |
| CVE-2026-102601 | 29 Sep 2026 | CVSS 3.5 | Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapterFlysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php… | Fix |
| CVE-2026-102630 | 29 Sep 2026 | CVSS 4.7 | unopimUnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing… | |
| CVE-2023-54400 | 29 Sep 2026 | CVSS 9.8 | Fumasoft Fumeng CloudFumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject… | |
| CVE-2026-100286 | 29 Sep 2026 | CVSS 6.5 | Devolutions ServerMissing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to… | |
| CVE-2026-100287 | 29 Sep 2026 | CVSS 5.4 | Devolutions ServerMissing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to… | |
| CVE-2026-100288 | 29 Sep 2026 | CVSS 7.2 | Devolutions ServerCleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the… | |
| CVE-2026-100289 | 29 Sep 2026 | CVSS 5.0 | Devolutions ServerMissing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user… | |
| CVE-2026-100308 | 29 Sep 2026 | CVSS 7.8 | AWS gluontsDeserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute… | |
| CVE-2026-86035 | 29 Sep 2026 | CVSS 8.5 | WeblateOrg weblateWeblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an… | |
| CVE-2026-63209 | 29 Sep 2026 | CVSS 7.5 | Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compresscompress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker… | Fix |
| CVE-2026-65102 | 29 Sep 2026 | CVSS 7.8 | NVIDIA DeepStreamNVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML… | |
| CVE-2026-68911 | 29 Sep 2026 | CVSS 8.7 | nicotine-plusNicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed… | |
| CVE-2026-49243 | 29 Sep 2026 | CVSS 9.6 | webminWebmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link to their… | |
| CVE-2026-22101 | 29 Sep 2026 | CVSS 5.1 | EVbee DC-80The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers… | |
| CVE-2026-22094 | 29 Sep 2026 | CVSS 9.3 | EVbee DC 80The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to… | |
| CVE-2026-102566 | 29 Sep 2026 | CVSS 7.8 | OpenNMT CTranslate2CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated… | |
| CVE-2026-102567 | 29 Sep 2026 | CVSS 6.1 | OpenNMT CTranslate2CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null… | |
| CVE-2026-102568 | 29 Sep 2026 | CVSS 5.5 | pardus-parental-controlPardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to… | |
| CVE-2026-102569 | 29 Sep 2026 | CVSS 5.5 | MacWarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter… | |
| CVE-2026-102570 | 29 Sep 2026 | CVSS 5.5 | MacWarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id… | |
| CVE-2026-102371 | 29 Sep 2026 | CVSS 5.7 | Canonical Ubuntu Pro for WSLIn wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu Pro by… | |
| CVE-2026-102491 | 29 Sep 2026 | CVSS 7.3 | mahonelau kykmsA vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function… | |
| CVE-2025-33207 | 29 Sep 2026 | CVSS 6.8 | NVIDIA BlueField GANVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the… | |
| CVE-2015-20122 | 29 Sep 2026 | CVSS 7.5 | Yonyou A6 OASeeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file… | |
| CVE-2026-97395 | 29 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache PolarisApache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as… | |
| CVE-2026-71898 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow… | |
| CVE-2026-71899 | 29 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache DolphinSchedulerA missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify… | |
| CVE-2026-78214 | 29 Sep 2026 | CVSS 5.3 | Apache Software Foundation Apache DolphinSchedulerAn authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required… | |
| CVE-2026-81569 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a… | |
| CVE-2026-86450 | 29 Sep 2026 | CVSS 7.5 | Parla Auto Automotive Trading Limited Company DetaWix Mobile Web PortalInsertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows… | |
| CVE-2026-102360 | 29 Sep 2026 | CVSS 8.6 | dmonad lib0A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticated remote… | |
| CVE-2026-102521 | 29 Sep 2026 | CVSS 8.6 | dmonad lib0The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer. The vulnerability allows… | |
| CVE-2026-4034 | 29 Sep 2026 | CVSS 8.7 | Tibco AdministratorInjection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through the… | |
| CVE-2026-71897 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on… | |
| CVE-2026-96869 | 29 Sep 2026 | CVSS 4.3 | Mozilla ThunderbirdInformation disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17… | |
| CVE-2026-98164 | 29 Sep 2026 | CVSS 5.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address spaces… | Fix |
| CVE-2026-76114 | 29 Sep 2026 | CVSS 5.9 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information… | |
| CVE-2026-76875 | 29 Sep 2026 | CVSS 5.3 | PyPyPyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that… | |
| CVE-2026-7192 | 29 Sep 2026 | CVSS 9.3 | Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi RouterA stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of service… | |
| CVE-2026-7193 | 29 Sep 2026 | CVSS 8.6 | Shenzhen Dbit Network Equipment T-CPE301K 4G Mini WiFi RouterA vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-router allows an attacker connected to the same… | |
| CVE-2026-82804 | 29 Sep 2026 | CVSS 8.8 | Apache Software Foundation Apache DolphinSchedulerThe scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command… | |
| CVE-2026-82973 | 29 Sep 2026 | CVSS 9.4 | psyb0t docker-mailboxImproper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated… | |
| CVE-2026-73598 | 29 Sep 2026 | CVSS 7.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource… | |
| CVE-2026-73599 | 29 Sep 2026 | CVSS 5.4 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect')… |
Page 141 of 168