[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111985 | 18 Oct 2026 | CVSS 4.3 | AUTOMATIC1111 stable-diffusion-webuiA vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file… | |
| CVE-2026-111998 | 18 Oct 2026 | CVSS 9.8 | vanus-labs vanusVanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by… | |
| CVE-2026-111999 | 18 Oct 2026 | CVSS 7.5 | vanus-labs vanusVanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any… | |
| CVE-2026-110880 | 18 Oct 2026 | CVSS 6.5 | Kit (formerly ConvertKit)Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110883 | 18 Oct 2026 | CVSS 6.5 | VideoWhisper.com 2Way VideoCalls and Random ChatAuthentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows… | |
| CVE-2026-110885 | 18 Oct 2026 | CVSS 6.5 | HivePressImproper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects… | |
| CVE-2026-110886 | 18 Oct 2026 | CVSS 9.8 | QuantumCloud Conversational Forms for ChatBotDeserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This… | |
| CVE-2026-110895 | 18 Oct 2026 | CVSS 8.5 | DevItems Support GenixImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite… | |
| CVE-2026-110897 | 18 Oct 2026 | CVSS 7.1 | IdeaBox Creations PowerPack Lite for Beaver BuilderImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver… | |
| CVE-2026-108485 | 18 Oct 2026 | CVSS 7.1 | ThemeGrill eStoreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected… | |
| CVE-2026-109894 | 18 Oct 2026 | CVSS 9.3 | Arraytics BookticsImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL… | |
| CVE-2026-109895 | 18 Oct 2026 | CVSS 7.1 | Arraytics BookticsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based… | |
| CVE-2026-110365 | 18 Oct 2026 | CVSS 6.5 | WPExperts Advanced File ManagerMissing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-110372 | 18 Oct 2026 | CVSS 9.8 | Brainstorm Force OttoKitIncorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from… | |
| CVE-2026-110373 | 18 Oct 2026 | CVSS 8.1 | Hamid Alinia Login with phone numberIncorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue… | |
| CVE-2026-110382 | 18 Oct 2026 | CVSS 7.1 | NSquared Simply Schedule AppointmentsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments… | |
| CVE-2026-110383 | 18 Oct 2026 | CVSS 7.5 | WP E-Signature Electronic Signature Add-on for Fluent FormsAuthorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms… | |
| CVE-2026-107436 | 18 Oct 2026 | CVSS 8.8 | WP Chill Strong TestimonialsDeserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong… | |
| CVE-2026-111877 | 18 Oct 2026 | CVSS 4.3 | dext34-morgan Books4CashA vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of the file… | |
| CVE-2026-111942 | 18 Oct 2026 | CVSS 4.3 | hrisikeshpal Blood_Bank_Management_SystemA weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. Impacted is an unknown function of the file /abs.php. This… | |
| CVE-2026-87844 | 18 Oct 2026 | CVSS 5.3 | Unknown PickPlugins Product Designer for WooCommerceThe PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is… | |
| CVE-2026-96534 | 18 Oct 2026 | CVSS 7.7 | Unknown Modern Events Calendar LiteThe Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape… | |
| CVE-2026-110031 | 18 Oct 2026 | CVSS 7.2 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary… | |
| CVE-2026-110032 | 18 Oct 2026 | CVSS 5.5 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers… | |
| CVE-2026-110033 | 18 Oct 2026 | CVSS 6.8 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the… | |
| CVE-2026-110035 | 18 Oct 2026 | CVSS 4.3 | Unknown Salon Booking SystemThe Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated… | |
| CVE-2026-110069 | 18 Oct 2026 | CVSS 4.3 | Unknown Modern Events Calendar LiteThe Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking… | |
| CVE-2026-110070 | 18 Oct 2026 | CVSS 6.5 | Unknown Modern Events Calendar LiteThe Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it… | |
| CVE-2026-110976 | 18 Oct 2026 | CVSS 4.9 | Unknown AI EngineThe AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before… | |
| CVE-2026-110981 | 18 Oct 2026 | CVSS 7.1 | Unknown WP Photo Album PlusThe WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a… | |
| CVE-2026-111041 | 18 Oct 2026 | CVSS 4.9 | Unknown AI EngineThe AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed… | |
| CVE-2026-110026 | 18 Oct 2026 | CVSS 4.9 | Unknown Tasty Recipes LiteThe Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms… | |
| CVE-2026-109937 | 18 Oct 2026 | CVSS 5.4 | Unknown Otter BlocksThe Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the… | |
| CVE-2026-111876 | 18 Oct 2026 | CVSS 5.3 | alexpasmantier televisionA vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file… | |
| CVE-2026-111874 | 18 Oct 2026 | CVSS 3.7 | OpenCATSA flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file modules/careers/CareersUI.php of the component Career… | |
| CVE-2026-111875 | 18 Oct 2026 | CVSS 4.7 | David-Crty DatabasementA vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file… | |
| CVE-2026-111873 | 18 Oct 2026 | CVSS 7.3 | itsmeravitejak Online-Examination-SystemA vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function… | |
| CVE-2026-111871 | 18 Oct 2026 | CVSS 7.3 | itsmeravitejak Online-Examination-SystemA weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an… | |
| CVE-2026-111872 | 18 Oct 2026 | CVSS 7.3 | itsmeravitejak Online-Examination-SystemA security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects… | |
| CVE-2026-111870 | 18 Oct 2026 | CVSS 5.3 | itsmeravitejak Online-Examination-SystemA security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element… | |
| CVE-2026-111869 | 18 Oct 2026 | CVSS 5.3 | makeplane planeA vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulation of… | |
| CVE-2026-111997 | 18 Oct 2026 | CVSS 6.3 | ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the processip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input… | Fix |
| CVE-2026-111868 | 18 Oct 2026 | CVSS 6.3 | datastax pulsar-jmsA vulnerability was determined in datastax pulsar-jms up to 9.0.3. This issue affects the function decode of the file… | |
| CVE-2026-111866 | 18 Oct 2026 | CVSS 7.3 | nemoTyrant manongA weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql… | |
| CVE-2026-111865 | 17 Oct 2026 | CVSS 5.3 | THU-MIG yoloeA security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b. This affects the function eval of the file… | |
| CVE-2026-111931 | 17 Oct 2026 | CVSS 4.3 | coderCoder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally… | |
| CVE-2026-111932 | 17 Oct 2026 | CVSS 3.4 | coderCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the… | |
| CVE-2026-111933 | 17 Oct 2026 | CVSS 3.7 | coderCoder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because… | |
| CVE-2026-111934 | 17 Oct 2026 | CVSS 3.7 | coderCoder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied… | |
| CVE-2026-111923 | 17 Oct 2026 | CVSS 7.5 | fleetdm fleetFleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers… | |
| CVE-2026-111924 | 17 Oct 2026 | CVSS 7.5 | fleetdm fleetFleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending… | |
| CVE-2026-111926 | 17 Oct 2026 | CVSS 3.3 | coderCoder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent… | |
| CVE-2026-111927 | 17 Oct 2026 | CVSS 7.7 | coderCoder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in… | |
| CVE-2026-111928 | 17 Oct 2026 | CVSS 5.4 | coderCoder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not… | |
| CVE-2026-111929 | 17 Oct 2026 | CVSS 5.3 | coderCoder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows… | |
| CVE-2026-111930 | 17 Oct 2026 | CVSS 4.3 | coderCoder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace… | |
| CVE-2026-111916 | 17 Oct 2026 | CVSS 5.3 | admidioAdmidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because… | |
| CVE-2026-111917 | 17 Oct 2026 | CVSS 6.5 | go-vikunja vikunjaVikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation… | |
| CVE-2026-111918 | 17 Oct 2026 | CVSS 5.4 | go-vikunja vikunjaVikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated users with… | |
| CVE-2026-111919 | 17 Oct 2026 | CVSS 6.5 | go-vikunja vikunjaVikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data… | |
| CVE-2026-111920 | 17 Oct 2026 | CVSS 4.3 | go-vikunja vikunjaVikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which resolves a user's effective… | |
| CVE-2026-111921 | 17 Oct 2026 | CVSS 5.4 | go-vikunja vikunjaVikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete admin-tier… | |
| CVE-2026-111922 | 17 Oct 2026 | CVSS 6.3 | go-vikunja vikunjaVikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when… | |
| CVE-2026-111908 | 17 Oct 2026 | CVSS 8.3 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT… | |
| CVE-2026-111909 | 17 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with… | |
| CVE-2026-111910 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attackers to… | |
| CVE-2026-111911 | 17 Oct 2026 | CVSS 9.8 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account… | |
| CVE-2026-111912 | 17 Oct 2026 | CVSS 6.5 | admidioAdmidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated… | |
| CVE-2026-111913 | 17 Oct 2026 | CVSS 4.3 | admidioAdmidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export… | |
| CVE-2026-111914 | 17 Oct 2026 | CVSS 6.5 | admidioAdmidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated… | |
| CVE-2026-111902 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ… | |
| CVE-2026-111903 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT… | |
| CVE-2026-111904 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden open… | |
| CVE-2026-111905 | 17 Oct 2026 | CVSS 6.0 | thorsten phpMyFAQphpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET… | |
| CVE-2026-111906 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch… | |
| CVE-2026-111907 | 17 Oct 2026 | CVSS 7.1 | thorsten phpMyFAQphpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes… | |
| CVE-2026-111894 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content… | |
| CVE-2026-111895 | 17 Oct 2026 | CVSS 6.8 | thorsten phpMyFAQphpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by… | |
| CVE-2026-111896 | 17 Oct 2026 | CVSS 5.4 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store… | |
| CVE-2026-111897 | 17 Oct 2026 | CVSS 7.1 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments… | |
| CVE-2026-111898 | 17 Oct 2026 | CVSS 7.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by… | |
| CVE-2026-111900 | 17 Oct 2026 | CVSS 4.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify… | |
| CVE-2026-111901 | 17 Oct 2026 | CVSS 7.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API… | |
| CVE-2026-111888 | 17 Oct 2026 | CVSS 2.7 | thorsten phpMyFAQphpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify… | |
| CVE-2026-111889 | 17 Oct 2026 | CVSS 4.3 | thorsten phpMyFAQphpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows… | |
| CVE-2026-111890 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right… | |
| CVE-2026-111891 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and… | |
| CVE-2026-111892 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and user/password/reset endpoints… | |
| CVE-2026-111893 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets… | |
| CVE-2026-111881 | 17 Oct 2026 | CVSS 7.6 | FreeRDPFreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to… | |
| CVE-2026-111882 | 17 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated… | |
| CVE-2026-111884 | 17 Oct 2026 | CVSS 8.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control… | |
| CVE-2026-111885 | 17 Oct 2026 | CVSS 5.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits… | |
| CVE-2026-111886 | 17 Oct 2026 | CVSS 6.5 | thorsten phpMyFAQphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated… | |
| CVE-2026-111887 | 17 Oct 2026 | CVSS 5.3 | thorsten phpMyFAQphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows unauthenticated attackers to… | |
| CVE-2025-71435 | 17 Oct 2026 | CVSS 4.2 | coderCoder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when… | |
| CVE-2026-110882 | 17 Oct 2026 | CVSS 4.3 | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order NotificationsMissing Authorization vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly… | |
| CVE-2026-111880 | 17 Oct 2026 | CVSS 7.4 | FreeRDPFreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC… | |
| CVE-2024-58398 | 17 Oct 2026 | CVSS 4.3 | coderCoder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the… | |
| CVE-2026-109701 | 17 Oct 2026 | CVSS 7.1 | PAYCOMET for WooCommerceImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET for WooCommerce… |
Page 40 of 168