[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-56727 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary In Zammad's inbound PGP email processing, the return… | |
| CVE-2026-56728 | 25 Sep 2026 | CVSS 5.3 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL… | |
| CVE-2026-97879 | 25 Sep 2026 | CVSS 5.3 | zhistaredu StarTrainingA security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file… | |
| CVE-2026-97871 | 25 Sep 2026 | CVSS 7.3 | Zhonglun CloudPosA vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file… | |
| CVE-2026-97877 | 25 Sep 2026 | CVSS 7.3 | zhistaredu StarTrainingA vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file… | |
| CVE-2026-97878 | 25 Sep 2026 | CVSS 7.3 | zhistaredu StarTrainingA vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the… | |
| CVE-2026-95834 | 25 Sep 2026 | CVSS 4.6 | Kovid Goyal kittyUse After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to… | |
| CVE-2026-95835 | 25 Sep 2026 | CVSS 5.6 | Kovid Goyal kittyMissing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the… | |
| CVE-2026-93363 | 25 Sep 2026 | CVSS 4.3 | payloadcms payloadThe @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to… | |
| CVE-2026-93364 | 25 Sep 2026 | CVSS 4.3 | Bludit CMSBludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page… | |
| CVE-2026-93365 | 25 Sep 2026 | CVSS 6.5 | Bludit CMSBludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read… | |
| CVE-2026-94445 | 25 Sep 2026 | CVSS 8.8 | golang.org/x/playgroundA malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one… | |
| CVE-2026-89032 | 25 Sep 2026 | CVSS 7.7 | BerriAI litellmBerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to… | |
| CVE-2026-91837 | 25 Sep 2026 | CVSS 7.8 | GNOME NetworkManager-iodineA flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the… | |
| CVE-2026-67421 | 25 Sep 2026 | CVSS 6.8 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP… | Fix |
| CVE-2026-80432 | 25 Sep 2026 | CVSS 6.0 | Kovid Goyal kittyMissing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the… | |
| CVE-2026-67410 | 25 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint… | Fix |
| CVE-2026-67411 | 25 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind… | Fix |
| CVE-2026-67412 | 25 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips… | |
| CVE-2026-67413 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's… | Fix |
| CVE-2026-67415 | 25 Sep 2026 | CVSS 4.9 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime… | |
| CVE-2026-67419 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can… | Fix |
| CVE-2026-67420 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains… | Fix |
| CVE-2026-67239 | 25 Sep 2026 | CVSS 5.4 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS… | |
| CVE-2026-67241 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange… | Fix |
| CVE-2026-67242 | 25 Sep 2026 | CVSS 5.4 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp… | Fix |
| CVE-2026-67406 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash… | |
| CVE-2026-67407 | 25 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838… | |
| CVE-2026-67408 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation… | Fix |
| CVE-2026-67409 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status… | |
| CVE-2026-67226 | 25 Sep 2026 | CVSS 4.9 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list… | Fix |
| CVE-2026-67227 | 25 Sep 2026 | CVSS 4.9 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter… | Fix |
| CVE-2026-67230 | 25 Sep 2026 | CVSS 7.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither… | Fix |
| CVE-2026-67234 | 25 Sep 2026 | CVSS 4.3 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the… | Fix |
| CVE-2026-67237 | 25 Sep 2026 | CVSS 9.3 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization… | Fix |
| CVE-2026-66073 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API… | Fix |
| CVE-2026-66078 | 25 Sep 2026 | CVSS 5.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE… | Fix |
| CVE-2026-67222 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every… | |
| CVE-2026-67223 | 25 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains… | Fix |
| CVE-2026-67225 | 25 Sep 2026 | CVSS 7.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value… | Fix |
| CVE-2026-56723 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket… | |
| CVE-2026-56724 | 25 Sep 2026 | CVSS 7.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base… | |
| CVE-2026-56729 | 25 Sep 2026 | CVSS 2.1 | zammadZammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned… | |
| CVE-2026-61837 | 25 Sep 2026 | CVSS 5.3 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full… | Fix |
| CVE-2026-66071 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag… | Fix |
| CVE-2026-18320 | 25 Sep 2026 | CVSS 6.1 | Readwise ReaderReadwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule… | |
| CVE-2026-100237 | 25 Sep 2026 | CVSS 6.1 | The Wikimedia Foundation Mediawiki - Thanks ExtensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Thanks… | |
| CVE-2026-100248 | 25 Sep 2026 | CVSS 8.4 | Rattadan Cosmowarp ContractThe Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin. | |
| CVE-2026-18311 | 25 Sep 2026 | CVSS 6.1 | Readwise ReaderReadwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document… | |
| CVE-2026-18312 | 25 Sep 2026 | CVSS 6.1 | Readwise ReaderReadwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application… | |
| CVE-2026-97868 | 25 Sep 2026 | CVSS 3.5 | sheshbabu zenA security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file… | |
| CVE-2026-97869 | 25 Sep 2026 | CVSS 4.1 | langchain4jA flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function… | |
| CVE-2026-96874 | 25 Sep 2026 | CVSS 2.3 | The Wikimedia Foundation Mediawiki - Cargo extensionImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored… | |
| CVE-2026-97469 | 25 Sep 2026 | CVSS 4.3 | DALIBO PostgreSQL AnonymizerPostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed… | |
| CVE-2026-92161 | 25 Sep 2026 | CVSS 9.8 | FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerFriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the… | Fix |
| CVE-2026-85274 | 25 Sep 2026 | CVSS 6.5 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes… | |
| CVE-2026-85289 | 25 Sep 2026 | CVSS 6.5 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane omits… | |
| CVE-2026-85290 | 25 Sep 2026 | CVSS 5.3 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Cron::recur()… | |
| CVE-2026-85291 | 25 Sep 2026 | CVSS 6.5 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's… | |
| CVE-2026-85292 | 25 Sep 2026 | CVSS 4.8 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's User_Controller… | |
| CVE-2026-85293 | 25 Sep 2026 | CVSS 4.8 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2-beta-1, InvoicePlane stores… | |
| CVE-2026-67236 | 25 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie… | Fix |
| CVE-2026-49850 | 25 Sep 2026 | CVSS 7.5 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes… | |
| CVE-2026-50547 | 25 Sep 2026 | CVSS 7.5 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's… | |
| CVE-2026-54790 | 25 Sep 2026 | CVSS 6.0 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an… | |
| CVE-2026-62262 | 25 Sep 2026 | CVSS 9.1 | PiwigoPiwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated… | |
| CVE-2026-39353 | 25 Sep 2026 | CVSS 9.1 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its… | |
| CVE-2026-39372 | 25 Sep 2026 | CVSS 4.9 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves… | |
| CVE-2026-42322 | 25 Sep 2026 | CVSS 9.1 | PiwigoPiwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo… | |
| CVE-2026-42323 | 25 Sep 2026 | CVSS 7.2 | PiwigoPiwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts… | |
| CVE-2026-42324 | 25 Sep 2026 | CVSS 7.2 | PiwigoPiwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores… | |
| CVE-2026-44642 | 25 Sep 2026 | CVSS 8.1 | PiwigoPiwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in… | |
| CVE-2026-100230 | 25 Sep 2026 | CVSS 5.3 | input-leap Input LeapInput Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \… | |
| CVE-2026-33639 | 25 Sep 2026 | CVSS 7.2 | InvoicePlaneInvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the… | |
| CVE-2026-97866 | 25 Sep 2026 | CVSS 5.6 | Zhonglun CloudPOSA weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the… | |
| CVE-2026-96812 | 25 Sep 2026 | CVSS 8.8 | Google gVisorImproper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platforms with… | |
| CVE-2026-84862 | 25 Sep 2026 | CVSS 7.2 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exploit… | |
| CVE-2026-84882 | 25 Sep 2026 | CVSS 6.5 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote… | |
| CVE-2026-88389 | 25 Sep 2026 | CVSS 6.2 | VulnerabilityEspruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary string input… | |
| CVE-2026-93030 | 25 Sep 2026 | CVSS 6.5 | IBM Financial Transaction Manager (FTM) for Redhat OpenShiftFTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw. | |
| CVE-2026-93306 | 25 Sep 2026 | CVSS 7.1 | IBM Server FirmwareIBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected… | Fix |
| CVE-2026-97864 | 25 Sep 2026 | CVSS 5.3 | GibbonEdu GibbonA vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file… | |
| CVE-2026-97865 | 25 Sep 2026 | CVSS 7.3 | Open-Web-AnalyticsA security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the… | |
| CVE-2026-98160 | 25 Sep 2026 | CVSS 5.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()… | Fix |
| CVE-2026-98161 | 25 Sep 2026 | CVSS 5.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep PREFLUSH before data writes pmem_submit_bio() records a… | Fix |
| CVE-2026-98162 | 25 Sep 2026 | CVSS 5.5 | LinuxIn the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree connection leak in smb2_tree_connect() See the procedure… | Fix |
| CVE-2026-97222 | 25 Sep 2026 | CVSS 5.5 | GNOME GnumericA heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element… | |
| CVE-2026-93834 | 25 Sep 2026 | CVSS 8.8 | Red Hat Enterprise Linux 10A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing… | |
| CVE-2026-93641 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Classic recipient clicks Accept Share… | |
| CVE-2026-93642 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated sender can forge a share notification that triggers stored XSS when a signed-in Zimbra Modern recipient clicks Accept Share… | |
| CVE-2026-93643 | 25 Sep 2026 | CVSS 9.8 | Zimbra Collaboration Suite (ZCS)When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can… | |
| CVE-2026-93647 | 25 Sep 2026 | CVSS 9.3 | Zimbra Collaboration Suite (ZCS)An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers… | |
| CVE-2026-85029 | 25 Sep 2026 | CVSS 8.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensitive information, delete arbitrary files, or execute arbitrary code… | |
| CVE-2026-85542 | 25 Sep 2026 | CVSS 8.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker… | |
| CVE-2026-85750 | 25 Sep 2026 | CVSS 7.2 | PiwigoPiwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to… | |
| CVE-2026-80430 | 25 Sep 2026 | CVSS 4.6 | Kovid Goyal kittyImproper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a… | |
| CVE-2026-80431 | 25 Sep 2026 | CVSS 6.8 | Kovid Goyal kittyOut-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the… | |
| CVE-2026-84884 | 25 Sep 2026 | CVSS 8.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated… | |
| CVE-2026-84893 | 25 Sep 2026 | CVSS 6.5 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to… | |
| CVE-2026-100176 | 25 Sep 2026 | CVSS 8.5 | ail project ail frameworkThe AIL Framework's username timeline feature is vulnerable to stored cross-site scripting (XSS). Usernames imported from chats and crawled forums… |
Page 152 of 168