[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100746 | 27 Sep 2026 | CVSS 7.3 | coollabsio CoolifyA vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect… | |
| CVE-2026-100863 | 27 Sep 2026 | CVSS 5.0 | heymrun heymHeym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py in 0.0.91… | |
| CVE-2026-100864 | 27 Sep 2026 | CVSS 8.8 | heymrun heymheym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows… | |
| CVE-2026-100865 | 27 Sep 2026 | CVSS 8.8 | heymrun heymHeym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service… | |
| CVE-2026-100856 | 27 Sep 2026 | CVSS 8.8 | AzuraCastAzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable… | |
| CVE-2026-100857 | 27 Sep 2026 | CVSS 8.0 | AzuraCastAzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string… | |
| CVE-2026-100858 | 27 Sep 2026 | CVSS 6.8 | heymrun heymheym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP… | |
| CVE-2026-100859 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared… | |
| CVE-2026-100860 | 27 Sep 2026 | CVSS 5.5 | heymrun heymheym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node… | |
| CVE-2026-100861 | 27 Sep 2026 | CVSS 5.0 | heymrun heymheym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to… | |
| CVE-2026-100862 | 27 Sep 2026 | CVSS 4.9 | heymrun heymheym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets… | |
| CVE-2026-100850 | 27 Sep 2026 | CVSS 7.7 | AzuraCastAzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch… | |
| CVE-2026-100851 | 27 Sep 2026 | CVSS 7.6 | AzuraCastAzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authenticated… | |
| CVE-2026-100852 | 27 Sep 2026 | CVSS 8.8 | AzuraCastAzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the… | |
| CVE-2026-100853 | 27 Sep 2026 | CVSS 5.9 | AzuraCastIn AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level access controls, allowing unauthenticated users to… | |
| CVE-2026-100854 | 27 Sep 2026 | CVSS 6.3 | AzuraCastAzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header… | |
| CVE-2026-100855 | 27 Sep 2026 | CVSS 6.5 | AzuraCastAzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{station_id}/file/{id}/play endpoint that allows… | |
| CVE-2026-100845 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with… | |
| CVE-2026-100846 | 27 Sep 2026 | CVSS 8.8 | Project-MONAI MONAIMONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickle function in monai/auto3dseg/utils.py. The… | |
| CVE-2026-100847 | 27 Sep 2026 | CVSS 7.5 | AzuraCastAzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can… | |
| CVE-2026-100848 | 27 Sep 2026 | CVSS 7.1 | AzuraCastAzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/https scheme… | |
| CVE-2026-100849 | 27 Sep 2026 | CVSS 7.1 | AzuraCastAzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in… | |
| CVE-2026-100838 | 27 Sep 2026 | CVSS 8.1 | edgelesssys contrastContrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI… | |
| CVE-2026-100839 | 27 Sep 2026 | CVSS 8.4 | edgelesssys contrastContrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest kernel's ACPI/AML handling is vulnerable to an AML… | |
| CVE-2026-100840 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbitrary… | |
| CVE-2026-100841 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIIn MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_meta=True with weights_only=True, forcing users… | |
| CVE-2026-100842 | 27 Sep 2026 | CVSS 8.8 | Project-MONAI MONAIMONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/bundle/scripts.py. The function validates shape… | |
| CVE-2026-100843 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads()… | |
| CVE-2026-100844 | 27 Sep 2026 | CVSS 7.8 | Project-MONAI MONAIMONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlled values… | |
| CVE-2026-100745 | 27 Sep 2026 | CVSS 6.3 | Edimax BR-6428nCA vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the… | |
| CVE-2026-100833 | 27 Sep 2026 | CVSS 9.6 | edgelesssys contrastContrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad… | |
| CVE-2026-100834 | 27 Sep 2026 | CVSS 5.9 | http4khttp4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonceVerifier… | |
| CVE-2026-100835 | 27 Sep 2026 | CVSS 7.4 | edgelesssys contrastContrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and… | |
| CVE-2026-100836 | 27 Sep 2026 | CVSS 4.3 | edgelesssys contrastContrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to… | |
| CVE-2026-100837 | 27 Sep 2026 | CVSS 3.7 | edgelesssys contrastContrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller… | |
| CVE-2026-100724 | 27 Sep 2026 | CVSS 5.4 | http4khttp4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default… | |
| CVE-2026-100725 | 27 Sep 2026 | CVSS 6.5 | http4khttp4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store used by… | |
| CVE-2026-100744 | 27 Sep 2026 | CVSS 7.3 | coollabsio CoolifyA flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file… | |
| CVE-2026-100723 | 27 Sep 2026 | CVSS 7.5 | vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundaryvm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned… | Fix |
| CVE-2026-100722 | 27 Sep 2026 | CVSS 6.8 | vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host processvm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls… | Fix |
| CVE-2025-71426 | 27 Sep 2026 | CVSS 7.1 | edgelesssys contrastContrast is a confidential-computing runtime for Kubernetes. In versions before 1.4.1, a recovering Coordinator does not verify the seed supplied by… | |
| CVE-2026-100721 | 27 Sep 2026 | CVSS 9.0 | vm2: NodeVM custom resolution bypasses external path boundariesvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a… | Fix |
| CVE-2025-71424 | 27 Sep 2026 | CVSS 3.5 | edgelesssys contrastContrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME… | |
| CVE-2025-71425 | 27 Sep 2026 | CVSS 7.3 | edgelesssys contrastContrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured… | |
| CVE-2025-71423 | 27 Sep 2026 | CVSS 7.3 | edgelesssys contrastEdgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert… | |
| CVE-2025-71422 | 27 Sep 2026 | CVSS 5.7 | edgelesssys contrastContrast is a Kubernetes runtime for confidential containers. In versions before 1.12.1, the secure persistent volume feature is vulnerable to a… | |
| CVE-2026-100740 | 27 Sep 2026 | CVSS 9.9 | D-Link DIR-895LA vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP… | |
| CVE-2026-100739 | 26 Sep 2026 | CVSS 7.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown… | |
| CVE-2026-94396 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94397 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94398 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94399 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94400 | 26 Sep 2026 | CVSS 6.5 | Elastic KibanaUncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-94408 | 26 Sep 2026 | CVSS 4.9 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | |
| CVE-2026-72662 | 26 Sep 2026 | CVSS 6.3 | Elastic KibanaAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via… | |
| CVE-2026-72668 | 26 Sep 2026 | CVSS 7.3 | Elastic KibanaUnintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user… | |
| CVE-2026-78582 | 26 Sep 2026 | CVSS 6.5 | Elastic KibanaMissing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-82294 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |
| CVE-2026-82300 | 26 Sep 2026 | CVSS 6.5 | ElasticsearchUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | |
| CVE-2026-82901 | 26 Sep 2026 | CVSS 9.8 | themefic Ultra Addons for Contact Form 7The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the… | |
| CVE-2026-85984 | 26 Sep 2026 | CVSS 9.8 | cyberlord92 miniOrange OTP Login, Verification and SMS NotificationsThe miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent… | |
| CVE-2026-77203 | 26 Sep 2026 | CVSS 8.8 | itthinx Groups – Memberships and Access ControlThe Groups – Memberships and Access Control plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.6.0… | |
| CVE-2026-94132 | 26 Sep 2026 | CVSS 8.1 | acymailing.com AcyMailing Enterprise extension for JoomlaJoomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME… | |
| CVE-2026-97160 | 26 Sep 2026 | CVSS 8.8 | lomart.fr UP plugin for JoomlaJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
| CVE-2026-97161 | 26 Sep 2026 | CVSS 7.5 | lomart.fr UP plugin for JoomlaJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
| CVE-2026-97162 | 26 Sep 2026 | CVSS 9.8 | lomart.fr UP plugin for JoomlaJoomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
| CVE-2026-97163 | 26 Sep 2026 | CVSS 9.8 | lomart.fr UP plugin for JoomlaJoomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
| CVE-2026-94131 | 26 Sep 2026 | CVSS 8.1 | acymailing.com AcyMailing extension for JoomlaJoomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a… | |
| CVE-2026-94130 | 26 Sep 2026 | CVSS 9.8 | joomlaboat.com YouTube Gallery extension for JoomlaJoomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video… | |
| CVE-2026-100719 | 26 Sep 2026 | CVSS 6.5 | froxlorFroxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd password… | |
| CVE-2026-100720 | 26 Sep 2026 | CVSS 8.7 | froxlorFroxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) uploads an SSL… | |
| CVE-2026-100713 | 26 Sep 2026 | CVSS 7.8 | froxlorFroxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron… | |
| CVE-2026-100714 | 26 Sep 2026 | CVSS 9.1 | froxlorFroxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the… | |
| CVE-2026-100715 | 26 Sep 2026 | CVSS 9.6 | froxlorFroxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8… | |
| CVE-2026-100716 | 26 Sep 2026 | CVSS 9.9 | froxlorFroxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate… | |
| CVE-2026-100717 | 26 Sep 2026 | CVSS 9.9 | froxlorfroxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only… | |
| CVE-2026-100718 | 26 Sep 2026 | CVSS 7.1 | froxlorFroxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has enabled… | |
| CVE-2026-100708 | 26 Sep 2026 | CVSS 7.1 | froxlorFroxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the… | |
| CVE-2026-100709 | 26 Sep 2026 | CVSS 7.5 | froxlorFroxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the… | |
| CVE-2026-100710 | 26 Sep 2026 | CVSS 4.9 | froxlorFroxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the admin… | |
| CVE-2026-100711 | 26 Sep 2026 | CVSS 7.5 | froxlorfroxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed. Attackers… | |
| CVE-2026-100712 | 26 Sep 2026 | CVSS 6.5 | froxlorfroxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA management… | |
| CVE-2026-100700 | 26 Sep 2026 | CVSS 7.5 | nodemailernodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quadratic… | |
| CVE-2026-100701 | 26 Sep 2026 | CVSS 5.9 | nodemailerNodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stores the… | |
| CVE-2026-100702 | 26 Sep 2026 | CVSS 5.9 | nodemailerNodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to cause… | |
| CVE-2026-100703 | 26 Sep 2026 | CVSS 7.7 | kyvernoKyverno 1.16.0 through 1.19.0 registers the globalcontext.Lib CEL library in its policy environment without confining it to the policy's namespace… | |
| CVE-2026-100704 | 26 Sep 2026 | CVSS 7.7 | kyvernoKyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evaluator never… | |
| CVE-2026-100705 | 26 Sep 2026 | CVSS 7.6 | kyvernoKyverno before 1.19.1 is vulnerable to server-side request forgery. The default egress blocklist (169.254.169.254, 169.254.169.253… | |
| CVE-2026-100706 | 26 Sep 2026 | CVSS 9.9 | kyvernokyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the… | |
| CVE-2026-100707 | 26 Sep 2026 | CVSS 7.7 | kyvernoKyverno before 1.19.1 contains a namespace isolation bypass in the apiCall context entry of namespaced Policy resources due to inconsistent path… | |
| CVE-2026-100693 | 26 Sep 2026 | CVSS 8.4 | gohugoio hugoHugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows… | |
| CVE-2026-100694 | 26 Sep 2026 | CVSS 6.1 | gohugoio hugoHugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without… | |
| CVE-2026-100695 | 26 Sep 2026 | CVSS 6.1 | vrana adminerAdminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without… | |
| CVE-2026-100696 | 26 Sep 2026 | CVSS 5.8 | vrana adminerAdminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver… | |
| CVE-2026-100697 | 26 Sep 2026 | CVSS 8.6 | vrana adminerAdminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is vulnerable… | |
| CVE-2026-100698 | 26 Sep 2026 | CVSS 5.8 | vrana adminerAdminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port… | |
| CVE-2026-100699 | 26 Sep 2026 | CVSS 5.3 | nodemailerNodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose… | |
| CVE-2026-100686 | 26 Sep 2026 | CVSS 8.1 | budibase serverBudibase versions before 3.45.0 fail to validate per-app authorization in the POST /api/global/groups/:groupId/apps endpoint, allowing builders to… | |
| CVE-2026-100687 | 26 Sep 2026 | CVSS 5.5 | budibase serverBudibase Server before 3.45.0 fails to redact plaintext datasource credentials before broadcasting external table updates to the Builder… | |
| CVE-2026-100688 | 26 Sep 2026 | CVSS 6.5 | budibase serverBudibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint… |
Page 148 of 168