[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-84714 | 23 Sep 2026 | CVSS 7.1 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject… | |
| CVE-2026-84716 | 23 Sep 2026 | CVSS 6.6 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install… | |
| CVE-2026-84717 | 23 Sep 2026 | CVSS 5.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC… | |
| CVE-2026-84718 | 23 Sep 2026 | CVSS 4.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the… | |
| CVE-2026-84719 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer… | |
| CVE-2026-84720 | 23 Sep 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the… | |
| CVE-2026-84721 | 23 Sep 2026 | CVSS 6.4 | Red Hat Ansible Automation Platform 2.7A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend… | |
| CVE-2026-84683 | 23 Sep 2026 | CVSS 8.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory… | |
| CVE-2026-84691 | 23 Sep 2026 | CVSS 8.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors… | |
| CVE-2026-84706 | 23 Sep 2026 | CVSS 7.6 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable… | |
| CVE-2026-84712 | 23 Sep 2026 | CVSS 5.3 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes… | |
| CVE-2026-84713 | 23 Sep 2026 | CVSS 6.5 | Red Hat Ansible Automation Platform 2.7A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API… | |
| CVE-2026-82405 | 23 Sep 2026 | CVSS 8.7 | Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes… | Fix |
| CVE-2026-82406 | 23 Sep 2026 | CVSS 7.1 | Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy… | Fix |
| CVE-2026-82407 | 23 Sep 2026 | CVSS 7.0 | Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime… | Fix |
| CVE-2026-82409 | 23 Sep 2026 | CVSS 8.4 | Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryKlever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the… | Fix |
| CVE-2026-75884 | 23 Sep 2026 | CVSS 9.1 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken… | |
| CVE-2026-66076 | 23 Sep 2026 | CVSS 6.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls… | |
| CVE-2026-66079 | 23 Sep 2026 | CVSS 7.5 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45… | |
| CVE-2026-67238 | 23 Sep 2026 | CVSS 7.1 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied… | |
| CVE-2026-68490 | 23 Sep 2026 | CVSS 8.2 | WebPros cPanelIncorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | |
| CVE-2026-68492 | 23 Sep 2026 | CVSS 8.7 | WebPros PleskAn untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to… | |
| CVE-2026-66070 | 23 Sep 2026 | CVSS 8.8 | rabbitmq-serverRabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin… | |
| CVE-2026-96770 | 23 Sep 2026 | CVSS 9.3 | Temporal Technologies, Inc. s2s-proxyAll published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert… | |
| CVE-2026-96872 | 23 Sep 2026 | CVSS 2.9 | The Wikimedia Foundation Mediawiki - WikiLambda ExtensionImproper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux… | |
| CVE-2026-96541 | 23 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the… | |
| CVE-2026-96545 | 23 Sep 2026 | CVSS 4.4 | Red Hat Enterprise Linux 10An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA… | |
| CVE-2026-96546 | 23 Sep 2026 | CVSS 2.5 | Red Hat Enterprise Linux 10A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds… | |
| CVE-2026-96548 | 23 Sep 2026 | CVSS 5.6 | sfturing hosp_orderA flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file… | |
| CVE-2026-96549 | 23 Sep 2026 | CVSS 3.3 | sfturing hosp_orderA vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the… | |
| CVE-2026-95600 | 23 Sep 2026 | CVSS 5.3 | TrustedLogin ConnectorUnauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. | |
| CVE-2026-95601 | 23 Sep 2026 | CVSS 9.3 | WBW Plugins Product Filter by WBWUnauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. | |
| CVE-2026-95602 | 23 Sep 2026 | CVSS 6.5 | YITH WooCommerce Request A QuoteAuthorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured… | |
| CVE-2026-95603 | 23 Sep 2026 | CVSS 7.2 | Victor Rodriguez Reycob Product Import ExportShop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | |
| CVE-2026-95604 | 23 Sep 2026 | CVSS 7.5 | Tangible Loops & LogicUnauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. | |
| CVE-2026-95528 | 23 Sep 2026 | CVSS 7.1 | Mohammed Kaludi Core Web Vitals & PageSpeed BoosterUnauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | |
| CVE-2026-95529 | 23 Sep 2026 | CVSS 7.1 | codepeople Calculated Fields FormUnauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. | |
| CVE-2026-95530 | 23 Sep 2026 | CVSS 6.5 | PixelYourSite – Your smart PIXEL (TAG) ManagerSubscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | |
| CVE-2026-95586 | 23 Sep 2026 | CVSS 6.5 | Themefic Ultimate Addons for Contact Form 7Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | |
| CVE-2026-95590 | 23 Sep 2026 | CVSS 7.1 | TainacanSubscriber SQL Injection in Tainacan <= 1.2.0 versions. | |
| CVE-2026-95592 | 23 Sep 2026 | CVSS 5.3 | Oleh RadiusTheme TeamUnauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. | |
| CVE-2026-95593 | 23 Sep 2026 | CVSS 7.6 | Ben Roberts UltimeterEditor SQL Injection in Ultimeter <= 3.0.8 versions. | |
| CVE-2026-95514 | 23 Sep 2026 | CVSS 5.3 | NetgsmUnauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. | |
| CVE-2026-95515 | 23 Sep 2026 | CVSS 7.1 | Kevin Stover Ninja FormsUnauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | |
| CVE-2026-95522 | 23 Sep 2026 | CVSS 7.6 | Syed Balkhi Easy Digital DownloadsShop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | |
| CVE-2026-95523 | 23 Sep 2026 | CVSS 6.5 | weDevs WP User FrontendSubscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | |
| CVE-2026-95524 | 23 Sep 2026 | CVSS 5.3 | weDevs WP User FrontendUnauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | |
| CVE-2026-95525 | 23 Sep 2026 | CVSS 6.5 | weDevs WP User FrontendSubscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. | |
| CVE-2026-95527 | 23 Sep 2026 | CVSS 6.5 | Conekta Group Conekta Payment GatewayUnauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | |
| CVE-2026-94671 | 23 Sep 2026 | CVSS 6.5 | RadiusTheme The Post GridContributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |
| CVE-2026-94679 | 23 Sep 2026 | CVSS 5.4 | WPManageNinja Fluent SupportSubscriber Broken Access Control in Fluent Support <= 2.3.2 versions. | |
| CVE-2026-94680 | 23 Sep 2026 | CVSS 6.5 | RadiusTheme The Post GridContributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |
| CVE-2026-94682 | 23 Sep 2026 | CVSS 6.5 | SecondLineThemes Podcast Importer SecondLineContributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | |
| CVE-2026-95513 | 23 Sep 2026 | CVSS 7.5 | vcita Online Booking & Scheduling Calendar for WordPress by vcitaUnauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. | |
| CVE-2026-94391 | 23 Sep 2026 | CVSS 6.5 | Rustaurius Ultimate FAQContributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | |
| CVE-2026-94457 | 23 Sep 2026 | CVSS 4.8 | WebFactory Captcha CodeUnauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | |
| CVE-2026-94461 | 23 Sep 2026 | CVSS 6.5 | metaphorcreations DittyContributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | |
| CVE-2026-94487 | 23 Sep 2026 | CVSS 8.1 | PublishPress CapabilitiesUnauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. | |
| CVE-2026-94498 | 23 Sep 2026 | CVSS 6.5 | AppMySiteUnauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | |
| CVE-2026-94500 | 23 Sep 2026 | CVSS 6.5 | Roxnor ElementsKit Elementor addons LiteContributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | |
| CVE-2026-94168 | 23 Sep 2026 | CVSS 6.5 | Leap13 Premium Addons for ElementorContributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | |
| CVE-2026-94174 | 23 Sep 2026 | CVSS 7.6 | WebFactory Email LogAdministrator SQL Injection in Email Log <= 2.63 versions. | |
| CVE-2026-94176 | 23 Sep 2026 | CVSS 7.1 | Kitae Park Mang Board WPUnauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. | |
| CVE-2026-94179 | 23 Sep 2026 | CVSS 7.1 | Razorpay Payment ButtonUnauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. | |
| CVE-2026-94181 | 23 Sep 2026 | CVSS 7.4 | The Browser Company of New York ArcAn address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that… | |
| CVE-2026-94079 | 23 Sep 2026 | CVSS 5.3 | WP User ManagerUnauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | |
| CVE-2026-94080 | 23 Sep 2026 | CVSS 5.3 | WebWizards MarketKingUnauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | |
| CVE-2026-94118 | 23 Sep 2026 | CVSS 6.5 | Leap13 Premium Blocks – Gutenberg Blocks for WordPressContributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | |
| CVE-2026-94124 | 23 Sep 2026 | CVSS 8.5 | levelfourdevelopment WP EasyCartContributor SQL Injection in WP EasyCart <= 5.9.4 versions. | |
| CVE-2026-93620 | 23 Sep 2026 | CVSS 6.5 | PayPlus Tech Team PayPlus Payment GatewayUnauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. | |
| CVE-2026-93622 | 23 Sep 2026 | CVSS 7.1 | NicolasKulka WPS Limit LoginUnauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | |
| CVE-2026-93623 | 23 Sep 2026 | CVSS 5.3 | Jordy Meow AI EngineUnauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. | |
| CVE-2026-93772 | 23 Sep 2026 | CVSS 6.5 | Tomdever wpForo ForumSubscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. | |
| CVE-2026-93773 | 23 Sep 2026 | CVSS 8.5 | Nick van Wobbie Mollie FormsContributor SQL Injection in Mollie Forms <= 2.11.0 versions. | |
| CVE-2026-93774 | 23 Sep 2026 | CVSS 7.1 | Jacob N. Breetvelt WP Photo Album PlusUnauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. | |
| CVE-2026-93421 | 23 Sep 2026 | CVSS 5.3 | Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointMesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes… | Fix |
| CVE-2026-93513 | 23 Sep 2026 | CVSS 4.3 | SiteSkiteContributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. | |
| CVE-2026-93526 | 23 Sep 2026 | CVSS 7.1 | Nexcess Event TicketsUnauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. | |
| CVE-2026-93527 | 23 Sep 2026 | CVSS 8.5 | bdthemes Live Copy Paste for ElementorContributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. | |
| CVE-2026-93529 | 23 Sep 2026 | CVSS 6.5 | Bilal Naseer WSP MCP – AI Agents ConnectorContributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | |
| CVE-2026-93618 | 23 Sep 2026 | CVSS 6.5 | Crocoblock. Jetimpex Inc. JetTricksImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows… | |
| CVE-2026-92692 | 23 Sep 2026 | CVSS 6.9 | Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release… | Fix |
| CVE-2026-92700 | 23 Sep 2026 | CVSS 6.3 | caddyserver caddyCaddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go… | |
| CVE-2026-92730 | 23 Sep 2026 | CVSS 7.4 | LimeSurveyLimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import… | |
| CVE-2026-90900 | 23 Sep 2026 | CVSS 5.3 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The… | |
| CVE-2026-90901 | 23 Sep 2026 | CVSS 8.6 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media… | |
| CVE-2026-90902 | 23 Sep 2026 | CVSS 8.6 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon… | |
| CVE-2026-90903 | 23 Sep 2026 | CVSS 7.2 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The… | |
| CVE-2026-90904 | 23 Sep 2026 | CVSS 8.6 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The… | |
| CVE-2026-90905 | 23 Sep 2026 | CVSS 7.2 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint… | |
| CVE-2026-92284 | 23 Sep 2026 | CVSS 6.9 | caddyserver caddyCaddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving… | |
| CVE-2026-90899 | 23 Sep 2026 | CVSS 8.2 | joomshaper.com Easy Store extension for JoomlaJoomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The… | |
| CVE-2026-84486 | 23 Sep 2026 | CVSS 8.2 | Red Hat Ansible Automation Platform 2.6 for RHEL 9A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and… | |
| CVE-2026-84499 | 23 Sep 2026 | CVSS 7.7 | Red Hat Ansible Automation Platform 2.5 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored… | |
| CVE-2026-84502 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that… | |
| CVE-2026-84474 | 23 Sep 2026 | CVSS 9.9 | Red Hat Ansible Automation Platform 2.4 for RHEL 8A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to… | |
| CVE-2026-82356 | 23 Sep 2026 | CVSS 7.5 | Imprivata Enterprise Access ManagementImprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair… | |
| CVE-2026-82368 | 23 Sep 2026 | CVSS 8.7 | Brocade SANnavInsecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate… | |
| CVE-2026-77601 | 23 Sep 2026 | CVSS 8.8 | OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an… | Fix |
| CVE-2026-77602 | 23 Sep 2026 | CVSS 9.9 | OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0… | Fix |
Page 164 of 168