[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-89098 | 16 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to… | |
| CVE-2026-80092 | 16 Oct 2026 | CVSS 5.3 | microsoft-identity-webAuthentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-81452 | 16 Oct 2026 | CVSS 7.0 | Dell Alienware Command Center (AWCC)Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with… | |
| CVE-2026-111717 | 16 Oct 2026 | CVSS 4.3 | nduckmink arkonArkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other… | |
| CVE-2026-111718 | 16 Oct 2026 | CVSS 6.5 | kuafuai aipexbaseAipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields… | |
| CVE-2026-111719 | 16 Oct 2026 | CVSS 5.9 | roncoo-payRoncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers… | |
| CVE-2026-111720 | 16 Oct 2026 | CVSS 5.3 | lhccong fish-island-backendfish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make… | |
| CVE-2026-111721 | 16 Oct 2026 | CVSS 5.4 | jingsewu open-wesOpen WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records… | |
| CVE-2026-111722 | 16 Oct 2026 | CVSS 8.1 | LingGuoAI LingGuo-DramaLingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users'… | |
| CVE-2026-111723 | 16 Oct 2026 | CVSS 8.8 | LingGuoAI LingGuo-DramaLingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through… | |
| CVE-2026-111709 | 16 Oct 2026 | CVSS 5.4 | canove whaticket-communityWhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access… | |
| CVE-2026-111710 | 16 Oct 2026 | CVSS 7.5 | Netcore NR256CNNetcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows… | |
| CVE-2026-111711 | 16 Oct 2026 | CVSS 9.8 | Netcore NR256CNNetcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which… | |
| CVE-2026-111712 | 16 Oct 2026 | CVSS 6.5 | Netcore NR256CNNetcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected… | |
| CVE-2026-111713 | 16 Oct 2026 | CVSS 5.4 | AmauriC tarteaucitron.jstarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the… | |
| CVE-2026-111714 | 16 Oct 2026 | CVSS 3.1 | AmauriC tarteaucitron.jstarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by… | |
| CVE-2026-111715 | 16 Oct 2026 | CVSS 4.3 | nduckmink arkonArkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments'… | |
| CVE-2026-111716 | 16 Oct 2026 | CVSS 5.4 | nduckmink arkonArkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources… | |
| CVE-2026-111702 | 16 Oct 2026 | CVSS 7.5 | sugarforever chat-ollamaChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users'… | |
| CVE-2026-111703 | 16 Oct 2026 | CVSS 6.3 | guchengwuyue yshop-crmyshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users'… | |
| CVE-2026-111704 | 16 Oct 2026 | CVSS 9.8 | langchatLangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST… | |
| CVE-2026-111705 | 16 Oct 2026 | CVSS 4.3 | fushengqian fuintFuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members'… | |
| CVE-2026-111706 | 16 Oct 2026 | CVSS 7.5 | vastxie 99AI99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers… | |
| CVE-2026-111707 | 16 Oct 2026 | CVSS 5.3 | vastxie 99AI99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat… | |
| CVE-2026-111708 | 16 Oct 2026 | CVSS 9.8 | canove whaticket-communityWhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as… | |
| CVE-2026-111695 | 16 Oct 2026 | CVSS 7.1 | shaiwz data-platform-openShaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace… | |
| CVE-2026-111696 | 16 Oct 2026 | CVSS 6.5 | shaiwz data-platform-opendata-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing authenticated… | |
| CVE-2026-111697 | 16 Oct 2026 | CVSS 6.5 | roinli HUIZHI-ChargeOS-cloudHUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that… | |
| CVE-2026-111698 | 16 Oct 2026 | CVSS 6.5 | roinli HUIZHI-ChargeOS-cloudHUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows… | |
| CVE-2026-111699 | 16 Oct 2026 | CVSS 4.8 | niefy wx-apiNiefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by… | |
| CVE-2026-111700 | 16 Oct 2026 | CVSS 7.1 | WebVella-ERPWebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text… | |
| CVE-2026-111701 | 16 Oct 2026 | CVSS 7.0 | OtterMind NubaseOtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects… | |
| CVE-2026-111688 | 16 Oct 2026 | CVSS 4.3 | Exrick xbootExrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role data-scope restrictions by… | |
| CVE-2026-111689 | 16 Oct 2026 | CVSS 4.3 | Exrick xbootExrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by… | |
| CVE-2026-111690 | 16 Oct 2026 | CVSS 9.8 | suyuan32 simple-admin-coreSimple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator… | |
| CVE-2026-111691 | 16 Oct 2026 | CVSS 7.4 | wimoor-erp wimoorWIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by… | |
| CVE-2026-111692 | 16 Oct 2026 | CVSS 9.8 | databufflabs databuffDataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session… | |
| CVE-2026-111693 | 16 Oct 2026 | CVSS 9.8 | databufflabs databuffDataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain… | |
| CVE-2026-111694 | 16 Oct 2026 | CVSS 5.3 | qiantongtech qKnowqKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow… | |
| CVE-2026-111681 | 16 Oct 2026 | CVSS 8.8 | smartloli EFAKEFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the… | |
| CVE-2026-111682 | 16 Oct 2026 | CVSS 6.5 | smartloli EFAKEFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys… | |
| CVE-2026-111683 | 16 Oct 2026 | CVSS 5.4 | allegro ralphAllegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model… | |
| CVE-2026-111684 | 16 Oct 2026 | CVSS 8.3 | absmach magistralaMagistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other… | |
| CVE-2026-111685 | 16 Oct 2026 | CVSS 7.5 | Thecosy IceCMSIceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num… | |
| CVE-2026-111686 | 16 Oct 2026 | CVSS 7.5 | Thecosy IceCMSIceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path… | |
| CVE-2026-111687 | 16 Oct 2026 | CVSS 9.8 | rachelos we-mp-rssWeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template… | |
| CVE-2026-111674 | 16 Oct 2026 | CVSS 4.3 | Hello-hao TbedTbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the… | |
| CVE-2026-111675 | 16 Oct 2026 | CVSS 7.4 | xiaochong0302 course-tencent-cloudCourse-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to… | |
| CVE-2026-111676 | 16 Oct 2026 | CVSS 4.3 | faveosuite faveo-helpdeskFaveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via… | |
| CVE-2026-111677 | 16 Oct 2026 | CVSS 5.5 | Adri van Os antiwordAntiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst… | |
| CVE-2026-111678 | 16 Oct 2026 | CVSS 3.3 | Adri van Os antiwordAntiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl… | |
| CVE-2026-111679 | 16 Oct 2026 | CVSS 5.4 | EKKOLearnAI ekko-studioEkko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear… | |
| CVE-2026-111680 | 16 Oct 2026 | CVSS 8.3 | APIParkLab APIParkAPIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and… | |
| CVE-2026-111669 | 16 Oct 2026 | CVSS 6.5 | izhaorui Zr.Admin.NETZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying… | |
| CVE-2026-111670 | 16 Oct 2026 | CVSS 4.3 | clickvisualClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged… | |
| CVE-2026-111671 | 16 Oct 2026 | CVSS 7.1 | data-infra cube-studioCube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or… | |
| CVE-2026-111672 | 16 Oct 2026 | CVSS 4.3 | data-infra cube-studioCube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view… | |
| CVE-2026-111673 | 16 Oct 2026 | CVSS 9.8 | Thecosy IceCMSIceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account… | |
| CVE-2026-111663 | 16 Oct 2026 | CVSS 8.6 | chaskiqChaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the… | |
| CVE-2026-111664 | 16 Oct 2026 | CVSS 4.4 | safing portmasterSafing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling… | |
| CVE-2026-111665 | 16 Oct 2026 | CVSS 5.4 | PiranhaCMS Piranha CMSPiranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated… | |
| CVE-2026-111666 | 16 Oct 2026 | CVSS 4.3 | steedos-platformSteedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report… | |
| CVE-2026-111667 | 16 Oct 2026 | CVSS 4.3 | getrebuild rebuildREBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged… | |
| CVE-2026-111668 | 16 Oct 2026 | CVSS 5.4 | beizhu-1209 AIHelmsAIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to… | |
| CVE-2026-111657 | 16 Oct 2026 | CVSS 4.3 | beikeshopBeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows… | |
| CVE-2026-111658 | 16 Oct 2026 | CVSS 3.8 | SiteServer SSCMSSiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access… | |
| CVE-2026-111659 | 16 Oct 2026 | CVSS 6.5 | wayn111 waynboot-mallWaynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the… | |
| CVE-2026-111660 | 16 Oct 2026 | CVSS 6.5 | wayn111 waynboot-mallwaynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending… | |
| CVE-2026-111661 | 16 Oct 2026 | CVSS 5.3 | wayn111 waynboot-mallwaynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling… | |
| CVE-2026-111662 | 16 Oct 2026 | CVSS 5.8 | chaskiqChaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary… | |
| CVE-2026-111650 | 16 Oct 2026 | CVSS 8.6 | HoshinoSuzumi chronoframeChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to… | |
| CVE-2026-111651 | 16 Oct 2026 | CVSS 6.5 | risesoft-y9 Digital-InfrastructureRisesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows… | |
| CVE-2026-111652 | 16 Oct 2026 | CVSS 5.3 | 3xxx engineercmsEngineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows unauthenticated attackers to… | |
| CVE-2026-111653 | 16 Oct 2026 | CVSS 5.3 | 53AIHub53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by… | |
| CVE-2026-111654 | 16 Oct 2026 | CVSS 6.3 | kerwincui FastBeeFastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users'… | |
| CVE-2026-111655 | 16 Oct 2026 | CVSS 3.8 | zoujingli think-plugs-adminThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read… | |
| CVE-2026-111656 | 16 Oct 2026 | CVSS 5.4 | zhimaAi chatwikiChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form… | |
| CVE-2026-111643 | 16 Oct 2026 | CVSS 9.8 | l429609201 misaka_danmu_serverMisaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary… | |
| CVE-2026-111644 | 16 Oct 2026 | CVSS 7.3 | l429609201 misaka_danmu_serverMisaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics… | |
| CVE-2026-111645 | 16 Oct 2026 | CVSS 5.4 | zmister2016 MrDocMrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify… | |
| CVE-2026-111646 | 16 Oct 2026 | CVSS 5.9 | javahuang SurveyKingSurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id… | |
| CVE-2026-111647 | 16 Oct 2026 | CVSS 4.3 | PickMall lilishopPickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers'… | |
| CVE-2026-111648 | 16 Oct 2026 | CVSS 2.7 | build-admin buildadminBuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other… | |
| CVE-2026-111649 | 16 Oct 2026 | CVSS 6.5 | rocboss paopao-ceRocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated… | |
| CVE-2026-111636 | 16 Oct 2026 | CVSS 8.1 | OpenBMB StaffDeckOpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session… | |
| CVE-2026-111637 | 16 Oct 2026 | CVSS 5.3 | Blair2004 NexoPOSNexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records… | |
| CVE-2026-111638 | 16 Oct 2026 | CVSS 7.7 | moul sshportalsshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated… | |
| CVE-2026-111639 | 16 Oct 2026 | CVSS 8.1 | mlogclub bbs-gobbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in… | |
| CVE-2026-111640 | 16 Oct 2026 | CVSS 5.4 | kuaifan dootaskDooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs… | |
| CVE-2026-111641 | 16 Oct 2026 | CVSS 9.8 | FastapiAdminFastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by… | |
| CVE-2026-111642 | 16 Oct 2026 | CVSS 8.8 | FastapiAdminFastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows low-privileged users to forge tokens… | |
| CVE-2026-111629 | 16 Oct 2026 | CVSS 4.3 | IoTSharpIoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data… | |
| CVE-2026-111630 | 16 Oct 2026 | CVSS 5.4 | colinin abp-next-adminabp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows… | |
| CVE-2026-111631 | 16 Oct 2026 | CVSS 5.4 | 10up DistributorDistributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX… | |
| CVE-2026-111632 | 16 Oct 2026 | CVSS 5.4 | aureuserpAureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed… | |
| CVE-2026-111633 | 16 Oct 2026 | CVSS 8.6 | SeriaWei ZKEACMSZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a… | |
| CVE-2026-111634 | 16 Oct 2026 | CVSS 8.1 | helicalinsightHelical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report… | |
| CVE-2026-111635 | 16 Oct 2026 | CVSS 4.3 | helicalinsightHelical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory… | |
| CVE-2026-111623 | 16 Oct 2026 | CVSS 5.6 | joey-zhou xiaozhi-esp32-server-javaXiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device… | |
| CVE-2026-111624 | 16 Oct 2026 | CVSS 3.7 | Umbraco-CMSUmbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice… |
Page 42 of 168