[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96415 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkCatapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-96416 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkIEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-96417 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkRF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-96418 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkTIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-96419 | 29 Sep 2026 | CVSS 7.8 | Wireshark Foundation WiresharkProfile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution | |
| CVE-2026-96420 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkToshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-96421 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkUSB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95389 | 29 Sep 2026 | CVSS 8.1 | Wireshark Foundation WiresharkSCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95390 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkPEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service | |
| CVE-2026-95391 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service | |
| CVE-2026-95392 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkMBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95393 | 29 Sep 2026 | CVSS 4.7 | Wireshark Foundation WiresharkCSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95394 | 29 Sep 2026 | CVSS 4.7 | Wireshark Foundation WiresharkMicrosoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95395 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkIEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95386 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkTTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service | |
| CVE-2026-95387 | 29 Sep 2026 | CVSS 8.8 | Wireshark Foundation WiresharkSPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-95388 | 29 Sep 2026 | CVSS 5.5 | Wireshark Foundation WiresharkSharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | |
| CVE-2026-8065 | 29 Sep 2026 | CVSS 9.1 | Hitachi Energy RTU500 series CMU firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated… | |
| CVE-2026-8066 | 29 Sep 2026 | CVSS 9.1 | Hitachi Energy RTU500 series CMU firmwareA directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker… | |
| CVE-2026-8067 | 29 Sep 2026 | CVSS 6.5 | Hitachi Energy RTU500 series CMU firmwareAn improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to… | |
| CVE-2026-8937 | 29 Sep 2026 | CVSS 4.3 | GitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under… | |
| CVE-2026-76720 | 29 Sep 2026 | CVSS 4.3 | Hewlett Packard Enterprise HPE OneViewA vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. | |
| CVE-2026-7395 | 29 Sep 2026 | CVSS 8.5 | Hitachi Energy Asset SuiteAsset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to… | |
| CVE-2026-81862 | 29 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Airflow Teradata providerApache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and… | Fix |
| CVE-2026-81914 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache Airflow Google providerApache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string… | Fix |
| CVE-2026-81930 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache Airflow Snowflake providerApache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The… | Fix |
| CVE-2026-84739 | 29 Sep 2026 | CVSS 8.7 | GitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under… | |
| CVE-2026-86843 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache Airflow Teradata providerThe Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them… | Fix |
| CVE-2026-11796 | 29 Sep 2026 | CVSS 5.1 | Hitachi Energy Asset SuiteAsset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and… | |
| CVE-2026-15390 | 29 Sep 2026 | CVSS 9.0 | DENX Software Engineering Das U-BootDas U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver… | |
| CVE-2026-19547 | 29 Sep 2026 | CVSS 7.0 | Artifex Software Inc. GhostscriptGhostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for… | |
| CVE-2026-4523 | 29 Sep 2026 | CVSS 3.7 | GitLabGitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under… | |
| CVE-2026-76718 | 29 Sep 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE OneViewA potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions. | |
| CVE-2026-76719 | 29 Sep 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE OneViewA security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions. | |
| CVE-2026-102473 | 29 Sep 2026 | CVSS 5.5 | Red Hat Enterprise Linux 6A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate… | |
| CVE-2026-102474 | 29 Sep 2026 | CVSS 4.0 | Red Hat Enterprise Linux 6A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five… | |
| CVE-2026-10518 | 29 Sep 2026 | CVSS 4.3 | GitLabGitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under… | |
| CVE-2026-96430 | 29 Sep 2026 | CVSS 8.7 | Flowring Technology Corp Agentflow 4.0Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote… | |
| CVE-2026-96431 | 29 Sep 2026 | CVSS 9.3 | Flowring Technology Corp Agentflow 4.0Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before… | |
| CVE-2026-96440 | 29 Sep 2026 | CVSS 7.1 | Flowring Technology Corp Agentflow 4.0Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring… | |
| CVE-2026-91048 | 29 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache KarafThe jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command… | |
| CVE-2026-91085 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache KarafApache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg)… | |
| CVE-2026-92142 | 29 Sep 2026 | CVSS 8.8 | Apache Software Foundation Apache KarafApache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked… | |
| CVE-2026-96428 | 29 Sep 2026 | CVSS 9.3 | Flowring Technology Corp Agentflow 4.0SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to… | |
| CVE-2026-96429 | 29 Sep 2026 | CVSS 9.3 | Flowring Technology Corp Agentflow 4.0SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to… | |
| CVE-2026-91012 | 29 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache Karaforg.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands… | |
| CVE-2026-84154 | 29 Sep 2026 | CVSS 9.9 | Dassault Systèmes GEOVIA Geospatial Data ManagerA Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could… | |
| CVE-2026-101169 | 29 Sep 2026 | CVSS 8.7 | Octopus Deploy Octopus ServerIn affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON… | |
| CVE-2026-86157 | 29 Sep 2026 | CVSS 5.6 | Progress Software Progress® Telerik® Fiddler® EverywhereExposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can… | |
| CVE-2026-86158 | 29 Sep 2026 | CVSS 7.7 | Progress Software Progress® Telerik® Fiddler® EverywhereMissing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated… | |
| CVE-2026-102292 | 29 Sep 2026 | CVSS 4.3 | coolbeans1212 MateisHomePage-WebsiteA flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown… | |
| CVE-2026-102293 | 29 Sep 2026 | CVSS 7.3 | realjerrytang tacomallA vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of… | |
| CVE-2026-102264 | 29 Sep 2026 | CVSS 3.5 | mwasikz robo-cafe-rmsA vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the… | |
| CVE-2026-102290 | 29 Sep 2026 | CVSS 3.5 | CodeCanyon Rocket LMSA vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload… | |
| CVE-2026-102263 | 29 Sep 2026 | CVSS 4.7 | mwasikz robo-cafe-rmsA vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function… | |
| CVE-2026-102261 | 29 Sep 2026 | CVSS 5.4 | owen2345 Camaleon CMSA flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file… | |
| CVE-2026-97024 | 29 Sep 2026 | CVSS 7.1 | Red Hat Enterprise Linux 10A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain… | |
| CVE-2026-97029 | 29 Sep 2026 | CVSS 5.7 | Red Hat Enterprise Linux 10Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching processes… | |
| CVE-2026-102414 | 29 Sep 2026 | CVSS 3.7 | pbkdf2 rehashes long passwords on every iteration, enabling denial of servicepbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password… | Fix |
| CVE-2026-102422 | 29 Sep 2026 | CVSS 8.1 | shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including… | Fix |
| CVE-2026-102247 | 29 Sep 2026 | CVSS 6.8 | FastAdminA vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file application/database.php of the… | |
| CVE-2026-102248 | 29 Sep 2026 | CVSS 7.3 | RebuildA vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of the file /user/login of the component Login… | |
| CVE-2026-102249 | 29 Sep 2026 | CVSS 7.3 | REBUILDA security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The… | |
| CVE-2026-102245 | 29 Sep 2026 | CVSS 7.3 | MODSetter SurfSenseA weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file… | |
| CVE-2026-97685 | 29 Sep 2026 | CVSS 7.1 | LimeSurveyAn authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying… | |
| CVE-2026-102243 | 29 Sep 2026 | CVSS 7.4 | MODSetter SurfSenseA vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file… | |
| CVE-2026-102244 | 29 Sep 2026 | CVSS 4.3 | MODSetter SurfSenseA security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file… | |
| CVE-2026-102241 | 29 Sep 2026 | CVSS 2.7 | Netcore NAP930A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file… | |
| CVE-2026-102240 | 29 Sep 2026 | CVSS 10.0 | Netcore NAP930A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component… | |
| CVE-2026-96326 | 29 Sep 2026 | CVSS 7.2 | htplugins HT Contact Form – Drag & Drop Form Builder for WordPressThe HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text… | |
| CVE-2026-101858 | 29 Sep 2026 | CVSS 4.7 | raspap-webguiA flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of the file… | |
| CVE-2026-101859 | 29 Sep 2026 | CVSS 5.4 | raspap-webguiA vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file… | |
| CVE-2026-101860 | 29 Sep 2026 | CVSS 8.8 | raspap-webguiA vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file… | |
| CVE-2026-101878 | 29 Sep 2026 | CVSS 7.5 | bitwarden serverBitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as… | |
| CVE-2026-101354 | 29 Sep 2026 | CVSS 9.6 | FAST FAC1203RA security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase… | |
| CVE-2026-101280 | 29 Sep 2026 | CVSS 7.3 | Trusted Domain Project OpenDMARCA vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component… | |
| CVE-2026-101281 | 29 Sep 2026 | CVSS 7.3 | Trusted Domain Project OpenDMARCA flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function… | |
| CVE-2026-102372 | 29 Sep 2026 | CVSS 6.1 | GestSupGestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store… | |
| CVE-2026-102373 | 29 Sep 2026 | CVSS 6.5 | GestSupGestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated… | |
| CVE-2026-102374 | 29 Sep 2026 | CVSS 6.1 | GestSupGestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email… | |
| CVE-2026-101278 | 29 Sep 2026 | CVSS 4.3 | Trusted Domain Project OpenDMARCA weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file… | |
| CVE-2026-101279 | 29 Sep 2026 | CVSS 6.5 | Trusted Domain Project OpenDMARCA security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file… | |
| CVE-2026-102367 | 29 Sep 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enabled flag… | |
| CVE-2026-18417 | 29 Sep 2026 | CVSS 6.5 | zephyrproject zephyrThe native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's void user_data field… | |
| CVE-2026-18746 | 29 Sep 2026 | CVSS 5.9 | zephyrproject zephyrparse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the… | |
| CVE-2026-18747 | 29 Sep 2026 | CVSS 6.8 | zephyrproject zephyrThe MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and then unconditionally strips… | |
| CVE-2026-101277 | 29 Sep 2026 | CVSS 6.5 | Trusted Domain Project OpenDKIMA security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set of the… | |
| CVE-2026-102361 | 29 Sep 2026 | CVSS 9.1 | gz-yami mall4jmall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset… | |
| CVE-2026-102362 | 29 Sep 2026 | CVSS 5.3 | gz-yami mall4jmall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can… | |
| CVE-2026-102363 | 29 Sep 2026 | CVSS 3.7 | gz-yami mall4jmall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthenticated… | |
| CVE-2026-102364 | 29 Sep 2026 | CVSS 5.4 | gz-yami mall4jmall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by… | |
| CVE-2026-102365 | 29 Sep 2026 | CVSS 6.5 | gz-yami mall4jmall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated… | |
| CVE-2026-102366 | 29 Sep 2026 | CVSS 4.4 | gz-yami mall4jmall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary… | |
| CVE-2026-101264 | 29 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This… | |
| CVE-2026-101265 | 29 Sep 2026 | CVSS 3.1 | Intelbras TIP 125iA vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such… | |
| CVE-2026-101263 | 29 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The… | |
| CVE-2026-102335 | 28 Sep 2026 | CVSS 7.1 | NginxProxyManager nginx-proxy-managerNginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to… | |
| CVE-2026-101261 | 28 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a… | |
| CVE-2026-101262 | 28 Sep 2026 | CVSS 9.1 | Ziroom ZHOME A0101A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The… | |
| CVE-2026-102332 | 28 Sep 2026 | CVSS 6.1 | amir20 dozzleDozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers… |
Page 143 of 168