[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-79850 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79851 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79852 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79853 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79854 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79855 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79856 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79857 | 22 Oct 2026 | CVSS 9.8 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79844 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79846 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79847 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-79848 | 22 Oct 2026 | CVSS 10.0 | Hewlett Packard Enterprise (HPE) Unknown productNo description provided | |
| CVE-2026-115517 | 22 Oct 2026 | CVSS 6.4 | KNIME Business HubUnrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open… | |
| CVE-2026-115519 | 22 Oct 2026 | CVSS 2.1 | KNIME Business HubMissing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise… | |
| CVE-2026-115393 | 22 Oct 2026 | CVSS 3.8 | bytecodealliance wasmtimeWasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3 contains a type confusion vulnerability because… | |
| CVE-2026-115394 | 22 Oct 2026 | CVSS 5.5 | NationalSecurityAgency ghidraGhidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read() that allows attackers to exhaust heap memory via… | |
| CVE-2026-115395 | 22 Oct 2026 | CVSS 5.5 | NationalSecurityAgency ghidraGhidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme() that extracts unlimited theme ZIP… | |
| CVE-2026-115396 | 22 Oct 2026 | CVSS 5.5 | NationalSecurityAgency ghidraGhidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in ThemeReader.processIconFile() that fails to limit… | |
| CVE-2026-115397 | 22 Oct 2026 | CVSS 5.5 | NationalSecurityAgency ghidraGhidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every… | |
| CVE-2026-115414 | 22 Oct 2026 | CVSS 7.8 | aws-sam-cliOS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan… | |
| CVE-2026-115387 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that allows guest… | |
| CVE-2026-115388 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimewasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the wasi:io/streams check-write… | |
| CVE-2026-115389 | 22 Oct 2026 | CVSS 2.3 | bytecodealliance wasmtimeWasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account for host allocations when lifting guest values… | |
| CVE-2026-115390 | 22 Oct 2026 | CVSS 5.7 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accounting flaw in Cranelift-compiled call_ref and try_table catch paths… | |
| CVE-2026-115391 | 22 Oct 2026 | CVSS 5.8 | bytecodealliance wasmtimeWasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation vulnerability in its WASIp3 implementation that… | |
| CVE-2026-115392 | 22 Oct 2026 | CVSS 7.9 | bytecodealliance wasmtimeWasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi… | |
| CVE-2026-115381 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory allocation in the wasmtime-wasi WASIp2… | |
| CVE-2026-115382 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in its wasi:http implementation that allows guests… | |
| CVE-2026-115383 | 22 Oct 2026 | CVSS 4.8 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modules… | |
| CVE-2026-115384 | 22 Oct 2026 | CVSS 9.9 | bytecodealliance wasmtimeWasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to… | |
| CVE-2026-115385 | 22 Oct 2026 | CVSS 6.2 | bytecodealliance wasmtimeWasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASIp3 implementation that… | |
| CVE-2026-115386 | 22 Oct 2026 | CVSS 2.6 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an information disclosure vulnerability in the WASIp1 fd_readdir… | |
| CVE-2026-115375 | 22 Oct 2026 | CVSS 9.9 | lxc incusIncus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files… | |
| CVE-2026-115376 | 22 Oct 2026 | CVSS 7.7 | lxc incusIncus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes… | |
| CVE-2026-115377 | 22 Oct 2026 | CVSS 9.9 | lxc incusIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources… | |
| CVE-2026-115378 | 22 Oct 2026 | CVSS 5.8 | lxc incusIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a… | |
| CVE-2026-115379 | 22 Oct 2026 | CVSS 5.7 | bytecodealliance wasmtimeWasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_call… | |
| CVE-2026-115380 | 22 Oct 2026 | CVSS 4.0 | bytecodealliance wasmtimeWasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview… | |
| CVE-2026-115366 | 22 Oct 2026 | CVSS 2.6 | openbaoOpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace tokens to modify plugin… | |
| CVE-2026-115369 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a CSR when use_csr_sans is… | |
| CVE-2026-115370 | 22 Oct 2026 | CVSS 4.3 | lxc incusIncus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass vulnerability that allows restricted project… | |
| CVE-2026-115371 | 22 Oct 2026 | CVSS 7.1 | lxc incusIncus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS… | |
| CVE-2026-115372 | 22 Oct 2026 | CVSS 8.5 | lxc incusIncus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume… | |
| CVE-2026-115373 | 22 Oct 2026 | CVSS 6.3 | lxc incusIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets… | |
| CVE-2026-115374 | 22 Oct 2026 | CVSS 7.1 | lxc incusIncus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to… | |
| CVE-2026-115359 | 22 Oct 2026 | CVSS 3.7 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with… | |
| CVE-2026-115360 | 22 Oct 2026 | CVSS 4.7 | openbaoOpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao… | |
| CVE-2026-115361 | 22 Oct 2026 | CVSS 4.1 | openbaoOpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules based on forbidden identity metadata templates… | |
| CVE-2026-115362 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method, leaving expired Secret IDs valid… | |
| CVE-2026-115363 | 22 Oct 2026 | CVSS 3.3 | openbaoOpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value… | |
| CVE-2026-115364 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header… | |
| CVE-2026-115365 | 22 Oct 2026 | CVSS 6.6 | openbaoOpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies… | |
| CVE-2026-115352 | 22 Oct 2026 | CVSS 7.5 | lepture mistuneMistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU… | |
| CVE-2026-115353 | 22 Oct 2026 | CVSS 8.6 | lepture mistuneMistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying… | |
| CVE-2026-115354 | 22 Oct 2026 | CVSS 6.5 | lepture mistuneMistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying… | |
| CVE-2026-115355 | 22 Oct 2026 | CVSS 7.5 | lepture mistuneMistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../… | |
| CVE-2026-115356 | 22 Oct 2026 | CVSS 5.4 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a token issued by the Kubernetes Auth method, that the service account… | |
| CVE-2026-115357 | 22 Oct 2026 | CVSS 2.2 | openbaoOpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and… | |
| CVE-2026-115358 | 22 Oct 2026 | CVSS 2.0 | openbaoOpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending… | |
| CVE-2026-114655 | 22 Oct 2026 | CVSS 5.9 | MongoDB libmongocryptlibmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider… | |
| CVE-2026-115347 | 22 Oct 2026 | CVSS 7.5 | lepture mistuneMistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of… | |
| CVE-2026-115348 | 22 Oct 2026 | CVSS 7.5 | lepture mistuneMistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows… | |
| CVE-2026-115349 | 22 Oct 2026 | CVSS 7.5 | lepture mistuneMistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in… | |
| CVE-2026-115350 | 22 Oct 2026 | CVSS 6.1 | lepture mistuneMistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html, .xhtml, or .htm file content… | |
| CVE-2026-115351 | 22 Oct 2026 | CVSS 4.7 | lepture mistuneMistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style… | |
| CVE-2026-114651 | 22 Oct 2026 | CVSS 4.0 | MongoDB C# DriverA memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content… | |
| CVE-2026-114652 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied… | |
| CVE-2026-114653 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is… | |
| CVE-2026-114654 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through… | |
| CVE-2026-114644 | 22 Oct 2026 | CVSS 5.9 | MongoDB C# DriverThe MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type… | |
| CVE-2026-114645 | 22 Oct 2026 | CVSS 5.2 | MongoDB C DriverA 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be… | |
| CVE-2026-114646 | 22 Oct 2026 | CVSS 6.5 | MongoDB C# DriverA data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or… | |
| CVE-2026-114647 | 22 Oct 2026 | CVSS 4.3 | MongoDB C# DriverThe MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other… | |
| CVE-2026-114648 | 22 Oct 2026 | CVSS 7.6 | MongoDB C# DriverThe MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries… | |
| CVE-2026-114649 | 22 Oct 2026 | CVSS 6.8 | MongoDB C# DriverThe MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached… | |
| CVE-2026-114650 | 22 Oct 2026 | CVSS 5.9 | MongoDB C# DriverA flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be… | |
| CVE-2026-114519 | 22 Oct 2026 | CVSS 8.6 | Roskus Prospero Flow CRMMissing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the… | |
| CVE-2026-114612 | 22 Oct 2026 | CVSS 9.9 | BerriAI litellmLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and… | |
| CVE-2026-114613 | 22 Oct 2026 | CVSS 7.5 | msgpack-pythonMessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a… | |
| CVE-2026-114643 | 22 Oct 2026 | CVSS 5.4 | MongoDB C# DriverThe MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and… | |
| CVE-2026-113875 | 22 Oct 2026 | CVSS 3.1 | SmileCDR HAPI FHIROn a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to… | |
| CVE-2026-113876 | 22 Oct 2026 | CVSS 4.3 | SmileCDR HAPI FHIRSmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a… | |
| CVE-2025-69723 | 22 Oct 2026 | Not scored yet | VulnerabilityA reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the… | |
| CVE-2025-65200 | 22 Oct 2026 | Not scored yet | VulnerabilityAn issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when… | |
| CVE-2022-51026 | 22 Oct 2026 | CVSS 9.8 | bytebaseBytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw… | |
| CVE-2026-93336 | 22 Oct 2026 | CVSS 7.1 | Canonical JujuMissing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a controller-authenticated principal (a unit… | |
| CVE-2026-97635 | 22 Oct 2026 | CVSS 8.1 | Agent ZeroThe Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads. When Agent Zero reproduces… | |
| CVE-2026-54532 | 22 Oct 2026 | CVSS 6.9 | CloudPirates-io helm-chartsCloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to cache… | |
| CVE-2026-77156 | 22 Oct 2026 | CVSS 6.4 | Checkmarx github.com/checkmarx/ast-cliIncomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA… | |
| CVE-2026-77157 | 22 Oct 2026 | CVSS 6.4 | Checkmarx github.com/checkmarx/ast-cliast-cli downloads two helper binaries, the Vorpal ASCA real-time engine and the SCA Resolver, from "download.checkmarx.com" as part of its… | |
| CVE-2026-114609 | 22 Oct 2026 | CVSS 5.8 | py-pdf fpdf2fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(S) URLs… | |
| CVE-2026-114610 | 22 Oct 2026 | CVSS 6.5 | py-pdf fpdf2fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG <use> references to… | |
| CVE-2026-114611 | 22 Oct 2026 | CVSS 9.1 | schorschii OCO-ServerOCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to… | |
| CVE-2026-115516 | 22 Oct 2026 | CVSS 6.9 | KNIME Business Hub SaaSAn incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub SaaS before version 1.19.0. A… | |
| CVE-2026-13599 | 22 Oct 2026 | CVSS 7.8 | ABB Ability EdgeniusMissing authentication for critical function vulnerability in ABB Ability Edgenius. This issue affects Ability Edgenius: through 3.2.3.0. | |
| CVE-2026-54238 | 22 Oct 2026 | CVSS 3.1 | supabase realtimeSupabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to version 2.103.1, the REST broadcast endpoints accept an… | |
| CVE-2026-113873 | 22 Oct 2026 | CVSS 7.5 | SmileCDR HAPI FHIRSmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that exhaust… | |
| CVE-2026-113874 | 22 Oct 2026 | CVSS 8.1 | SmileCDR HAPI FHIRSmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not enforce… | |
| CVE-2026-108357 | 22 Oct 2026 | CVSS 8.8 | PHPOffice PhpSpreadsheetPhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored… | |
| CVE-2026-108358 | 22 Oct 2026 | CVSS 8.8 | PHPOffice PhpSpreadsheetPhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan… |
Page 2 of 168