[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-73591 | 23 Sep 2026 | CVSS 7.5 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code… | |
| CVE-2026-73858 | 23 Sep 2026 | CVSS 5.3 | Solspace Freeform: Limited Twig template injection via submitted field valuesSolspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform… | Fix |
| CVE-2026-73586 | 23 Sep 2026 | CVSS 6.4 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low… | |
| CVE-2026-73587 | 23 Sep 2026 | CVSS 6.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An… | |
| CVE-2026-73588 | 23 Sep 2026 | CVSS 7.4 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function… | |
| CVE-2026-73589 | 23 Sep 2026 | CVSS 6.3 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password… | |
| CVE-2026-71177 | 23 Sep 2026 | CVSS 5.4 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames… | |
| CVE-2026-71178 | 23 Sep 2026 | CVSS 3.7 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization… | |
| CVE-2026-61834 | 23 Sep 2026 | CVSS 4.3 | scim-patch: Mutation of Inherited Built-in Method Objectsscim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain… | Fix |
| CVE-2026-62998 | 23 Sep 2026 | CVSS 4.3 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request… | Fix |
| CVE-2026-63000 | 23 Sep 2026 | CVSS 6.4 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in… | Fix |
| CVE-2026-63001 | 23 Sep 2026 | CVSS 4.8 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php… | Fix |
| CVE-2026-63002 | 23 Sep 2026 | CVSS 4.8 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesREDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles… | Fix |
| CVE-2026-55610 | 23 Sep 2026 | CVSS 8.7 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-61413 | 23 Sep 2026 | CVSS 6.8 | Dell Secure Connect Gateway (SCG) Policy ManagerDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low… | |
| CVE-2026-96560 | 23 Sep 2026 | CVSS 9.8 | ModelTC LightLLMLightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes… | |
| CVE-2026-96512 | 23 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z'… | |
| CVE-2026-86679 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged… | |
| CVE-2026-86681 | 23 Sep 2026 | CVSS 7.6 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged… | |
| CVE-2026-86683 | 23 Sep 2026 | CVSS 8.1 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings. | |
| CVE-2026-86708 | 23 Sep 2026 | CVSS 10.0 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the… | |
| CVE-2026-86677 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially… | |
| CVE-2026-86678 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine Applications ManagerZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to… | |
| CVE-2026-18177 | 23 Sep 2026 | CVSS 7.1 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing… | |
| CVE-2026-18179 | 23 Sep 2026 | CVSS 6.5 | IBM Financial Transaction Manager (FTM) for RedHat OpenShiftIBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper… | |
| CVE-2026-59167 | 23 Sep 2026 | CVSS 10.0 | SunEditor: Critical XSS vulnerability - sanitizer bypassSunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js… | Fix |
| CVE-2026-12974 | 23 Sep 2026 | CVSS 7.9 | Forcepoint Security Engine (NGFW)A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): from 7.1.0… | |
| CVE-2026-95676 | 23 Sep 2026 | CVSS 7.5 | WatchGuard AuthPoint Authentication GatewayA missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker… | Fix |
| CVE-2026-86246 | 23 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache Tomcat NativeInitialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including… | |
| CVE-2026-86247 | 23 Sep 2026 | CVSS 7.4 | Apache Software Foundation Apache Tomcat NativeRace condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some… | |
| CVE-2026-84091 | 23 Sep 2026 | CVSS 5.3 | Unknown SUMIT Payment Gateway for WooCommerceThe SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is… | |
| CVE-2026-86243 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Tomcat NativeBuffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue… | |
| CVE-2026-76978 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the… | |
| CVE-2026-76979 | 23 Sep 2026 | CVSS 7.7 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule… | |
| CVE-2026-76980 | 23 Sep 2026 | CVSS 7.4 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall… | |
| CVE-2026-77112 | 23 Sep 2026 | CVSS 6.5 | Global IT Informatics Technology Services Inc. WeollServer-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery. This… | |
| CVE-2026-75825 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass… | |
| CVE-2026-19599 | 23 Sep 2026 | CVSS 9.9 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile… | |
| CVE-2026-84791 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that… | |
| CVE-2026-86248 | 23 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache TomcatCLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects… | |
| CVE-2026-86350 | 23 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatInconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for… | |
| CVE-2026-87022 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatImproper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is… | |
| CVE-2026-96445 | 23 Sep 2026 | CVSS 6.8 | Red Hat Build of KeycloakA flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system… | |
| CVE-2026-96446 | 23 Sep 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none… | |
| CVE-2026-78253 | 23 Sep 2026 | CVSS 2.3 | qtUncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via… | |
| CVE-2026-78383 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatAllocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing… | |
| CVE-2026-78437 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user… | |
| CVE-2026-79677 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatMissing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a… | |
| CVE-2026-80444 | 23 Sep 2026 | CVSS 5.4 | Abis Technology Ltd. Co. AVESİSURL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue… | |
| CVE-2026-84787 | 23 Sep 2026 | CVSS 8.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that… | |
| CVE-2026-84789 | 23 Sep 2026 | CVSS 7.1 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that… | |
| CVE-2026-73581 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache TomcatImproper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when… | |
| CVE-2026-75973 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache TomcatImproper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default… | |
| CVE-2026-76183 | 23 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache TomcatAuthentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed… | |
| CVE-2026-77756 | 23 Sep 2026 | CVSS 3.7 | Apache Software Foundation Apache TomcatInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the… | |
| CVE-2026-77762 | 23 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache TomcatConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to… | |
| CVE-2026-77791 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatUncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects… | |
| CVE-2026-12370 | 23 Sep 2026 | CVSS 7.6 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side… | |
| CVE-2026-14913 | 23 Sep 2026 | CVSS 8.8 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule… | |
| CVE-2026-15358 | 23 Sep 2026 | CVSS 7.5 | Zohocorp ManageEngine OpManagerZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal… | |
| CVE-2026-96442 | 23 Sep 2026 | CVSS 7.8 | GNU EmacsA code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute… | |
| CVE-2026-96455 | 23 Sep 2026 | CVSS 8.8 | Pollen Robotics Reachy MiniThe Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in… | |
| CVE-2026-96456 | 23 Sep 2026 | CVSS 6.3 | Pollen Robotics Reachy MiniThe Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the… | |
| CVE-2026-90950 | 23 Sep 2026 | CVSS 5.3 | Unknown Paid Membership SubscriptionsThe Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent… | |
| CVE-2026-87070 | 23 Sep 2026 | CVSS 5.3 | Unknown Forminator FormsThe Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied… | |
| CVE-2026-87071 | 23 Sep 2026 | CVSS 5.3 | Unknown Forminator FormsThe Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the… | |
| CVE-2026-87848 | 23 Sep 2026 | CVSS 3.7 | Unknown MPCX LightboxThe MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to… | |
| CVE-2026-87978 | 23 Sep 2026 | CVSS 5.3 | Unknown Paymob for WooCommerceThe Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing… | |
| CVE-2026-86604 | 23 Sep 2026 | CVSS 4.8 | Unknown GTranslateThe GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a… | |
| CVE-2026-86612 | 23 Sep 2026 | CVSS 5.6 | Unknown Ninja TablesThe Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default… | |
| CVE-2026-86601 | 23 Sep 2026 | CVSS 6.5 | Unknown WP Recipe MakerThe WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's… | |
| CVE-2026-5695 | 23 Sep 2026 | CVSS 8.4 | Microweber Administration panelArbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server… | |
| CVE-2026-5696 | 23 Sep 2026 | CVSS 5.9 | Microweber Administration panelReflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the… | |
| CVE-2026-96454 | 23 Sep 2026 | CVSS 8.2 | tw93 PakePake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and… | |
| CVE-2026-91928 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-91999 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-92001 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-94243 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache Sling Security BundleA vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security… | |
| CVE-2026-94251 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Sling Security BundleA vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache… | |
| CVE-2026-95626 | 23 Sep 2026 | CVSS 8.3 | tauriTauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application… | |
| CVE-2026-95627 | 23 Sep 2026 | CVSS 7.7 | tauri-plugin-dialogWhen a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to… | |
| CVE-2026-96443 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache DorisInsufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. | |
| CVE-2026-73192 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSAn improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref()… | |
| CVE-2026-79616 | 23 Sep 2026 | CVSS 0.6 | qtOut-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path. | |
| CVE-2026-91852 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-93368 | 23 Sep 2026 | CVSS 7.5 | travispluse Rename wp-login.php to anything you wantThe Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all… | |
| CVE-2026-95625 | 23 Sep 2026 | CVSS 5.9 | tauri-plugin-updaterThe Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest… | |
| CVE-2026-31377 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache DorisAn Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal… | |
| CVE-2026-42801 | 23 Sep 2026 | CVSS 7.4 | ASR Crane，FalconNULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated… | |
| CVE-2026-15027 | 23 Sep 2026 | CVSS 8.8 | Changing CGServiSignCGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious… | |
| CVE-2026-91817 | 23 Sep 2026 | CVSS 6.1 | Foxit Software Inc. Foxit PDF EditorA heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient… | |
| CVE-2026-91818 | 23 Sep 2026 | CVSS 5.5 | Foxit Software Inc. Foxit PDF EditorA use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during… | |
| CVE-2026-92378 | 23 Sep 2026 | CVSS 4.1 | NT-ware uniFLOW OnlineA session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions… | |
| CVE-2026-91809 | 23 Sep 2026 | CVSS 7.8 | Foxit Software Inc. Foxit PDF EditorA use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name… | |
| CVE-2026-91810 | 23 Sep 2026 | CVSS 6.1 | Foxit Software Inc. Foxit PDF EditorA heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata… | |
| CVE-2026-91811 | 23 Sep 2026 | CVSS 7.8 | Foxit Software Inc. Foxit PDF EditorA heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in… | |
| CVE-2026-91812 | 23 Sep 2026 | CVSS 8.1 | Foxit Software Inc. Foxit PDF EditorA vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package… | |
| CVE-2026-91813 | 23 Sep 2026 | CVSS 7.8 | Foxit Software Inc. Foxit PDF EditorA vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction… | |
| CVE-2026-91814 | 23 Sep 2026 | CVSS 5.3 | Foxit Software Inc. Foxit PDF EditorA signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document… | |
| CVE-2026-91815 | 23 Sep 2026 | CVSS 7.8 | Foxit Software Inc. Foxit PDF EditorFoxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write… |
Page 166 of 168