[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110889 | 17 Oct 2026 | CVSS 7.5 | Gantry 5 FrameworkGeneration of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive… | |
| CVE-2026-109983 | 17 Oct 2026 | CVSS 6.4 | wssoffice21 YMC FilterThe YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and… | |
| CVE-2026-110253 | 17 Oct 2026 | CVSS 5.4 | boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPressThe weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to… | |
| CVE-2026-111110 | 17 Oct 2026 | CVSS 7.2 | stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaidThe Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-100316 | 17 Oct 2026 | CVSS 7.2 | davidanderson European VAT Compliance Assistant for WooCommerceThe European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in… | |
| CVE-2026-110384 | 17 Oct 2026 | CVSS 7.1 | Heateor Support Fancy Comments WordPressImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress… | |
| CVE-2026-92431 | 17 Oct 2026 | CVSS 3.7 | Unknown Patreon WordPressThe Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to… | |
| CVE-2026-92432 | 17 Oct 2026 | CVSS 4.3 | Unknown Patreon WordPressThe Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated… | |
| CVE-2026-92433 | 17 Oct 2026 | CVSS 6.5 | Unknown Patreon WordPressThe Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a… | |
| CVE-2026-97314 | 17 Oct 2026 | CVSS 6.5 | Unknown ThirstyAffiliatesThe ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler… | |
| CVE-2026-104122 | 17 Oct 2026 | CVSS 6.8 | Unknown Ukr-To-LatThe Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with… | |
| CVE-2026-104246 | 17 Oct 2026 | CVSS 5.9 | Unknown Contact Form 7 Signature AddonThe Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path… | |
| CVE-2026-106470 | 17 Oct 2026 | CVSS 5.0 | Unknown WP Data AccessThe WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user… | |
| CVE-2026-110527 | 17 Oct 2026 | CVSS 5.3 | Unknown WP User ManagerThe WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the… | |
| CVE-2026-81343 | 17 Oct 2026 | CVSS 5.3 | Unknown ACF Frontend Admin by DynamiAppsThe ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions… | |
| CVE-2026-81344 | 17 Oct 2026 | CVSS 6.6 | Unknown ACF Frontend Admin by DynamiAppsThe ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises… | |
| CVE-2026-91074 | 17 Oct 2026 | CVSS 6.8 | Unknown BSK PDF ManagerThe BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could… | |
| CVE-2026-103376 | 17 Oct 2026 | CVSS 5.3 | Unknown PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70… | |
| CVE-2026-92715 | 17 Oct 2026 | CVSS 4.3 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… | |
| CVE-2026-92798 | 17 Oct 2026 | CVSS 8.1 | wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login BuilderThe User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This… | |
| CVE-2026-92978 | 17 Oct 2026 | CVSS 4.3 | wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login BuilderThe User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login… | |
| CVE-2026-96660 | 17 Oct 2026 | CVSS 7.2 | wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login BuilderThe User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login… | |
| CVE-2026-110268 | 17 Oct 2026 | CVSS 4.9 | wpazleen Post Export Import with MediaThe Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the… | |
| CVE-2026-111726 | 17 Oct 2026 | CVSS 6.4 | themifyme Themify BuilderThe Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'visible' Shortcode Attribute in all versions up to, and… | |
| CVE-2026-109368 | 17 Oct 2026 | CVSS 6.5 | murgroland WP Booking System – Booking CalendarThe WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… | |
| CVE-2026-109369 | 17 Oct 2026 | CVSS 6.8 | murgroland WP Booking System – Booking CalendarThe WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3… | |
| CVE-2026-109985 | 17 Oct 2026 | CVSS 6.4 | wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDNThe xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-109989 | 17 Oct 2026 | CVSS 6.4 | themifyme Themify PopupThe Themify Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'popup_width_unit' parameter in all versions up to, and… | |
| CVE-2026-107744 | 17 Oct 2026 | CVSS 6.5 | thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesThe LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions… | |
| CVE-2026-107752 | 17 Oct 2026 | CVSS 4.9 | uscnanbu Welcart e-CommerceThe Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql /… | |
| CVE-2026-108123 | 17 Oct 2026 | CVSS 7.5 | murgroland WP Booking System – Booking CalendarThe WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3… | |
| CVE-2026-103899 | 17 Oct 2026 | CVSS 7.2 | daigo75 EU VAT Assistant for WooCommerceThe EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all versions… | |
| CVE-2026-104736 | 17 Oct 2026 | CVSS 9.8 | thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesThe LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted… | |
| CVE-2026-107762 | 17 Oct 2026 | CVSS 7.5 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… | |
| CVE-2026-107763 | 17 Oct 2026 | CVSS 4.3 | hostspa Fastcache by Host.itThe Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the… | |
| CVE-2026-109208 | 17 Oct 2026 | CVSS 7.2 | thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online CoursesThe LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the… | |
| CVE-2026-110653 | 17 Oct 2026 | CVSS 9.1 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race… | |
| CVE-2026-111601 | 17 Oct 2026 | CVSS 6.1 | hippooo Hippoo Mobile App for WooCommerceThe Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all… | |
| CVE-2026-111602 | 17 Oct 2026 | CVSS 3.7 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure… | |
| CVE-2026-104734 | 17 Oct 2026 | CVSS 7.2 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… | |
| CVE-2026-111823 | 17 Oct 2026 | CVSS 9.8 | mage-aiMage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. | |
| CVE-2026-111853 | 17 Oct 2026 | CVSS 8.8 | Tektronix 3 Series MDOAn issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve… | |
| CVE-2026-111854 | 17 Oct 2026 | CVSS 8.1 | Tektronix 3 Series MDOAn issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface… | |
| CVE-2026-111855 | 17 Oct 2026 | CVSS 7.5 | Tektronix 3 Series MDOAn issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the… | |
| CVE-2026-89085 | 16 Oct 2026 | CVSS 6.6 | Red Hat Enterprise Linux 10A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation… | |
| CVE-2026-89088 | 16 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing… | |
| CVE-2026-89096 | 16 Oct 2026 | CVSS 5.9 | Red Hat Enterprise Linux 10A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification… | |
| CVE-2026-110758 | 16 Oct 2026 | CVSS 7.5 | VulnerabilityText::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under… | |
| CVE-2026-110759 | 16 Oct 2026 | CVSS 9.8 | VulnerabilityText::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When… | |
| CVE-2026-111802 | 16 Oct 2026 | CVSS 6.6 | Red Hat Enterprise Linux 10A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without… | |
| CVE-2026-17591 | 16 Oct 2026 | CVSS 3.6 | Red Hat Hardened ImagesA flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free… | |
| CVE-2026-110752 | 16 Oct 2026 | CVSS 7.5 | VulnerabilityText::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment… | |
| CVE-2026-110753 | 16 Oct 2026 | CVSS 9.8 | VulnerabilityText::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in… | |
| CVE-2026-110754 | 16 Oct 2026 | CVSS 6.5 | VulnerabilityText::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record… | |
| CVE-2026-110755 | 16 Oct 2026 | CVSS 7.5 | VulnerabilityText::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol… | |
| CVE-2026-110756 | 16 Oct 2026 | CVSS 9.8 | VulnerabilityText::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in… | |
| CVE-2026-110757 | 16 Oct 2026 | CVSS 9.8 | VulnerabilityText::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine. combine and print do… | |
| CVE-2026-96626 | 16 Oct 2026 | CVSS 8.5 | getarcaneapp arcaneArcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in… | |
| CVE-2026-96627 | 16 Oct 2026 | CVSS 8.8 | Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go… | Fix |
| CVE-2026-96628 | 16 Oct 2026 | CVSS 4.3 | Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts… | Fix |
| CVE-2026-68498 | 16 Oct 2026 | CVSS 7.5 | FasterXML jackson-coreStreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume… | |
| CVE-2026-62438 | 16 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to… | |
| CVE-2026-62439 | 16 Oct 2026 | CVSS 7.0 | Red Hat Enterprise Linux 10A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a… | |
| CVE-2026-49410 | 16 Oct 2026 | CVSS 8.1 | tinyhumansai openhumanOpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request… | |
| CVE-2026-111044 | 16 Oct 2026 | CVSS 7.6 | LizardByte SunshineSunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that… | |
| CVE-2026-108372 | 16 Oct 2026 | CVSS 7.1 | LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown filesOpen and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5… | Fix |
| CVE-2026-96542 | 16 Oct 2026 | CVSS 5.0 | Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer)Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537… | |
| CVE-2026-64862 | 16 Oct 2026 | CVSS 6.5 | frappe hrmsFrappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not… | |
| CVE-2026-55796 | 16 Oct 2026 | CVSS 6.5 | frappe hrmsFrappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs… | |
| CVE-2026-108373 | 16 Oct 2026 | CVSS 6.5 | frappe erpnextERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise… | |
| CVE-2026-108374 | 16 Oct 2026 | CVSS 7.7 | frappe erpnextERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to… | |
| CVE-2026-96620 | 16 Oct 2026 | CVSS 9.2 | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command ExecutionClaude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without… | Fix |
| CVE-2026-68572 | 16 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache KylinExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4… | |
| CVE-2026-68573 | 16 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache KylinImproper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services… | |
| CVE-2026-69076 | 16 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache KylinExposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public… | |
| CVE-2026-69077 | 16 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache KylinExposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to… | |
| CVE-2026-69080 | 16 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache KylinExposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are… | |
| CVE-2026-30971 | 16 Oct 2026 | CVSS 8.8 | zoneminderZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an… | |
| CVE-2026-59963 | 16 Oct 2026 | CVSS 7.1 | TandoorRecipes recipesTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints… | |
| CVE-2026-59966 | 16 Oct 2026 | CVSS 5.7 | TandoorRecipes recipesTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled… | |
| CVE-2026-59970 | 16 Oct 2026 | CVSS 7.7 | TandoorRecipes recipesTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an… | |
| CVE-2026-61726 | 16 Oct 2026 | CVSS 8.1 | TandoorRecipes recipesTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and… | |
| CVE-2026-108743 | 16 Oct 2026 | CVSS 8.8 | Apache Software Foundation Apache KylinImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin… | |
| CVE-2026-108709 | 16 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache KylinAuthentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which… | |
| CVE-2026-102607 | 16 Oct 2026 | CVSS 8.8 | zoneminderZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the… | |
| CVE-2026-102608 | 16 Oct 2026 | CVSS 9.0 | zoneminderZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name… | |
| CVE-2026-102834 | 16 Oct 2026 | CVSS 7.5 | JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSJavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer… | Fix |
| CVE-2026-85231 | 16 Oct 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC… | |
| CVE-2026-85977 | 16 Oct 2026 | CVSS 5.3 | Red Hat Hardened ImagesA flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client… | |
| CVE-2026-17068 | 16 Oct 2026 | CVSS 5.4 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag. | |
| CVE-2026-17073 | 16 Oct 2026 | CVSS 5.4 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. | |
| CVE-2026-17275 | 16 Oct 2026 | CVSS 3.7 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper… | |
| CVE-2026-17488 | 16 Oct 2026 | CVSS 4.3 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | |
| CVE-2026-17491 | 16 Oct 2026 | CVSS 5.4 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the… | |
| CVE-2026-111793 | 16 Oct 2026 | CVSS 4.3 | Openwave Messaging (Ireland) Limited Webtop Media TranscoderOpenwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may… | |
| CVE-2026-107674 | 16 Oct 2026 | CVSS 5.1 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting… | |
| CVE-2026-102917 | 16 Oct 2026 | CVSS 7.8 | IBM iIBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to… | |
| CVE-2025-55653 | 16 Oct 2026 | CVSS 5.5 | VulnerabilityGPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file… | |
| CVE-2025-66969 | 16 Oct 2026 | CVSS 7.5 | VulnerabilityInteger overflow in OpenModSim (<=1.11.0), leading to denial of service | |
| CVE-2025-55640 | 16 Oct 2026 | Not scored yet | VulnerabilityA heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
Page 41 of 168