[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-112836 | 20 Oct 2026 | CVSS 8.8 | e4jvikwp VikRentCarCross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar… | |
| CVE-2026-112840 | 20 Oct 2026 | CVSS 6.5 | Brainstorm Force SureCartImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows… | |
| CVE-2026-112823 | 20 Oct 2026 | CVSS 4.3 | WP User ManagerMissing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User… | |
| CVE-2026-112824 | 20 Oct 2026 | CVSS 5.3 | Magepeople inc. Bus Ticket Booking with Seat ReservationMissing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows… | |
| CVE-2026-112829 | 20 Oct 2026 | CVSS 5.3 | Arraytics BookticsMissing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-109700 | 20 Oct 2026 | CVSS 6.5 | eLightUp Meta Box – WordPress Custom Fields FrameworkMissing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-111763 | 20 Oct 2026 | CVSS 5.7 | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the… | Fix |
| CVE-2026-111764 | 20 Oct 2026 | CVSS 7.5 | A2A Java SDK has a fail-open default task authorizationA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs… | Fix |
| CVE-2026-111765 | 20 Oct 2026 | CVSS 7.5 | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the… | Fix |
| CVE-2026-111843 | 20 Oct 2026 | CVSS 6.5 | CozyThemes RootbloxImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows Stored… | |
| CVE-2025-71436 | 20 Oct 2026 | CVSS 7.1 | librdf Raptor RDF Syntax LibraryRaptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_term_from_counted_literal()… | |
| CVE-2026-107755 | 20 Oct 2026 | CVSS 6.0 | Apache Software Foundation Apache CouchDBInsufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to… | |
| CVE-2026-95168 | 20 Oct 2026 | CVSS 7.8 | VulnerabilityAn issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and… | |
| CVE-2026-96402 | 20 Oct 2026 | CVSS 5.2 | Eclipse Foundation Eclipse ThreadX - USBXA malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents… | |
| CVE-2026-97400 | 20 Oct 2026 | CVSS 6.8 | Eclipse Foundation Eclipse OpenJ9In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the… | |
| CVE-2026-91186 | 20 Oct 2026 | CVSS 8.4 | Eclipse Foundation Eclipse ThreadX - GUIXThe PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency… | |
| CVE-2026-91189 | 20 Oct 2026 | CVSS 7.1 | Eclipse Foundation Eclipse ThreadX - GUIXThe GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and… | |
| CVE-2026-92162 | 20 Oct 2026 | CVSS 7.2 | flatpakFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at… | |
| CVE-2026-92446 | 20 Oct 2026 | CVSS 6.8 | Eclipse Foundation Eclipse ThreadX - GUIX`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BINRES_DATA_INFO` has no field… | |
| CVE-2026-92449 | 20 Oct 2026 | CVSS 6.8 | Eclipse Foundation Eclipse ThreadX - GUIX`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource… | |
| CVE-2026-92454 | 20 Oct 2026 | CVSS 6.1 | Eclipse Foundation Eclipse ThreadX - GUIXThe GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated… | |
| CVE-2026-95111 | 20 Oct 2026 | CVSS 4.8 | Eclipse Foundation Eclipse ThreadXA memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the… | |
| CVE-2026-91059 | 20 Oct 2026 | CVSS 6.8 | Eclipse Foundation Eclipse ThreadX - GUIXThe GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header after `SOS` re-runs the frame… | |
| CVE-2026-113466 | 20 Oct 2026 | CVSS 5.3 | MinIOA security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function… | |
| CVE-2026-113397 | 20 Oct 2026 | CVSS 7.4 | DrayTek Vigor2960A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file… | |
| CVE-2026-113411 | 20 Oct 2026 | CVSS 6.3 | Nerimity DesktopA vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of… | |
| CVE-2026-112942 | 20 Oct 2026 | CVSS 7.5 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windowslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an… | Fix |
| CVE-2026-112943 | 20 Oct 2026 | CVSS 6.3 | launch-editor: escapeCmdArgs() omits % escaping on Windowslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when… | Fix |
| CVE-2026-112944 | 20 Oct 2026 | CVSS 6.3 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorslaunch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry… | Fix |
| CVE-2026-112934 | 20 Oct 2026 | CVSS 6.1 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another… | Fix |
| CVE-2026-112935 | 20 Oct 2026 | CVSS 4.7 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its… | Fix |
| CVE-2026-112936 | 20 Oct 2026 | CVSS 6.1 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve… | Fix |
| CVE-2026-112937 | 20 Oct 2026 | CVSS 6.1 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock-* private-hard-link… | Fix |
| CVE-2026-112939 | 20 Oct 2026 | CVSS 4.7 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that… | Fix |
| CVE-2026-112940 | 20 Oct 2026 | CVSS 7.1 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by… | Fix |
| CVE-2026-112941 | 20 Oct 2026 | CVSS 3.3 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful… | Fix |
| CVE-2026-112906 | 20 Oct 2026 | CVSS 4.7 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when… | |
| CVE-2026-112909 | 20 Oct 2026 | CVSS 6.1 | tox-dev filelockfilelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when… | |
| CVE-2026-112911 | 20 Oct 2026 | CVSS 6.3 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock… | Fix |
| CVE-2026-112912 | 20 Oct 2026 | CVSS 2.5 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the… | Fix |
| CVE-2026-112914 | 20 Oct 2026 | CVSS 5.3 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it… | Fix |
| CVE-2026-112915 | 20 Oct 2026 | CVSS 5.5 | tox-dev filelockfilelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without… | Fix |
| CVE-2026-112833 | 20 Oct 2026 | CVSS 6.5 | Castos Seriously Simple PodcastingImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting… | |
| CVE-2026-112834 | 20 Oct 2026 | CVSS 5.3 | Castos Seriously Simple PodcastingMissing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-111762 | 20 Oct 2026 | CVSS 5.7 | A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in… | Fix |
| CVE-2026-111761 | 20 Oct 2026 | CVSS 5.8 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryA2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends… | Fix |
| CVE-2026-88041 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This… | Fix |
| CVE-2026-91041 | 20 Oct 2026 | CVSS 7.8 | Eclipse Foundation Eclipse ThreadX - FileXMounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is… | |
| CVE-2026-93446 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from… | Fix |
| CVE-2026-96406 | 20 Oct 2026 | CVSS 4.9 | Eclipse Foundation Eclipse ThreadX - USBXA VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. The USBX… | |
| CVE-2026-96582 | 20 Oct 2026 | CVSS 4.9 | Eclipse Foundation Eclipse ThreadX - USBXA HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by… | |
| CVE-2026-80353 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatTime-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector… | Fix |
| CVE-2026-74048 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatNot Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS… | Fix |
| CVE-2026-74049 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatExecution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1… | Fix |
| CVE-2026-113394 | 20 Oct 2026 | CVSS 7.4 | DrayTek Vigor2960A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file… | |
| CVE-2026-113395 | 20 Oct 2026 | CVSS 7.4 | DrayTek Vigor2960A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file… | |
| CVE-2026-113396 | 20 Oct 2026 | CVSS 7.4 | DrayTek Vigor2960A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file… | |
| CVE-2026-113393 | 20 Oct 2026 | CVSS 6.3 | DrayTek Vigor2960A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file… | |
| CVE-2026-103119 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatBuffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the… | Fix |
| CVE-2026-101356 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatIncorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or… | Fix |
| CVE-2026-101296 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatA missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL… | Fix |
| CVE-2026-34484 | 20 Oct 2026 | Not scored yet | Nokia 1830 Global Express (GX)Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface. An… | |
| CVE-2026-34485 | 20 Oct 2026 | Not scored yet | Nokia 1830 Global Express (GX)Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH… | |
| CVE-2026-113400 | 20 Oct 2026 | CVSS 5.4 | Mozilla FirefoxUninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | Fix |
| CVE-2026-113401 | 20 Oct 2026 | CVSS 6.5 | Mozilla FirefoxDenial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | Fix |
| CVE-2026-113470 | 20 Oct 2026 | CVSS 5.4 | Mozilla FirefoxCryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR… | Fix |
| CVE-2026-113619 | 20 Oct 2026 | CVSS 7.5 | Eclipse Foundation Eclipse ioFogIn Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an… | |
| CVE-2026-113620 | 20 Oct 2026 | CVSS 9.8 | Eclipse Foundation Eclipse ioFogIn Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The… | |
| CVE-2026-113390 | 20 Oct 2026 | CVSS 9.9 | DrayTek Vigor2960A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file… | |
| CVE-2026-113391 | 20 Oct 2026 | CVSS 9.9 | DrayTek Vigor2960A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file… | |
| CVE-2026-113392 | 20 Oct 2026 | CVSS 7.4 | DrayTek Vigor2960A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi… | |
| CVE-2026-113399 | 20 Oct 2026 | Not scored yet | Mozilla FirefoxIncorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | Fix |
| CVE-2026-105941 | 20 Oct 2026 | CVSS 8.1 | Red Hat streams for Apache Kafka 3The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling… | |
| CVE-2026-14933 | 20 Oct 2026 | CVSS 8.6 | Unblu inc. Unblu SparkCross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and… | |
| CVE-2026-18205 | 20 Oct 2026 | CVSS 6.1 | Ticimax Informatics Technologies Inc. Ticimax E-Commerce PlatformImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax… | |
| CVE-2026-113385 | 20 Oct 2026 | CVSS 5.3 | LeeDrOiD Labs Shortcutter 2 AppA vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file… | |
| CVE-2026-113388 | 20 Oct 2026 | CVSS 4.3 | opensource-socialnetworkA security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file… | |
| CVE-2026-113389 | 20 Oct 2026 | CVSS 9.9 | DrayTek Vigor2960A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file… | |
| CVE-2026-113495 | 20 Oct 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to background… | |
| CVE-2026-113496 | 20 Oct 2026 | CVSS 5.0 | Red Hat Enterprise Linux 10A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed directly as a… | |
| CVE-2026-113583 | 20 Oct 2026 | CVSS 6.1 | cypht-org cyphtCypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary… | |
| CVE-2026-105311 | 20 Oct 2026 | CVSS 7.7 | Red Hat StreamsHub Console for Apache Kafka®The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set… | |
| CVE-2026-105312 | 20 Oct 2026 | CVSS 9.9 | Red Hat StreamsHub Console for Apache Kafka®A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The… | |
| CVE-2026-105949 | 20 Oct 2026 | CVSS 8.8 | Red Hat streams for Apache Kafka 2Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and… | |
| CVE-2026-9589 | 20 Oct 2026 | CVSS 9.3 | Unblu inc. Unblu SparkMissing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on… | |
| CVE-2026-113356 | 20 Oct 2026 | CVSS 7.5 | DokuWikiDokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize()… | |
| CVE-2026-113357 | 20 Oct 2026 | CVSS 3.5 | tester-army @e2e-dev/github@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by… | |
| CVE-2026-113358 | 20 Oct 2026 | CVSS 7.5 | lavalite cmsLavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download… | |
| CVE-2026-113382 | 20 Oct 2026 | CVSS 6.3 | arizu-id fast-tunnelA security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file… | |
| CVE-2026-113383 | 20 Oct 2026 | CVSS 4.3 | Optimal IdM OptimalCloudA vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a… | |
| CVE-2026-113384 | 20 Oct 2026 | CVSS 4.3 | Optimal IdM OptimalCloudA flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of… | |
| CVE-2026-113349 | 20 Oct 2026 | CVSS 4.3 | OpenCATSOpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated… | |
| CVE-2026-113350 | 20 Oct 2026 | CVSS 5.4 | marmelab react-adminreact-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in… | |
| CVE-2026-113351 | 20 Oct 2026 | CVSS 5.9 | libexpatlibexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets… | |
| CVE-2026-113352 | 20 Oct 2026 | CVSS 7.5 | uToxuTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to… | |
| CVE-2026-113353 | 20 Oct 2026 | CVSS 5.4 | ThimPress LearnPressLearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor… | |
| CVE-2026-113354 | 20 Oct 2026 | CVSS 6.5 | Finsys dockhandDockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through… | |
| CVE-2026-113355 | 20 Oct 2026 | CVSS 4.8 | chatwootChatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting… | |
| CVE-2026-112783 | 20 Oct 2026 | CVSS 4.3 | OpenCATSOpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level… | |
| CVE-2026-112784 | 20 Oct 2026 | CVSS 4.3 | OpenCATSOpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail… |
Page 28 of 168