[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-89062 | 16 Oct 2026 | CVSS 5.5 | Lenovo Energy Management DriverA potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated user to… | |
| CVE-2026-92629 | 16 Oct 2026 | CVSS 7.3 | Lenovo Baiying PC ClientA potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could… | |
| CVE-2026-92777 | 16 Oct 2026 | CVSS 6.4 | Lenovo Idea Tab Pro (TB373FU)A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass device… | |
| CVE-2026-89057 | 16 Oct 2026 | CVSS 6.8 | Lenovo Idea Tab Pro (TB373FU)A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized… | |
| CVE-2026-16754 | 16 Oct 2026 | CVSS 4.8 | Lenovo Smart Camera C33A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market… | |
| CVE-2026-16755 | 16 Oct 2026 | CVSS 5.3 | Lenovo Smart Camera C33A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauthorized… | |
| CVE-2026-75941 | 16 Oct 2026 | CVSS 8.0 | Lenovo Legion Zone ApplicationA potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an… | |
| CVE-2026-84823 | 16 Oct 2026 | CVSS 7.1 | Red Hat Enterprise Linux 8A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path… | |
| CVE-2026-111210 | 16 Oct 2026 | CVSS 7.3 | bitcoinjA vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component… | |
| CVE-2026-96806 | 15 Oct 2026 | CVSS 5.8 | Apache Software Foundation Apache Airflow Keycloak providerThe Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware`… | |
| CVE-2026-94134 | 15 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache Airflow SSH providerThe Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is… | |
| CVE-2026-94135 | 15 Oct 2026 | CVSS 4.3 | Apache Software Foundation Apache Airflow SFTP providerThe Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by… | |
| CVE-2026-92228 | 15 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache Airflow Keycloak providerThe Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs… | |
| CVE-2026-111369 | 15 Oct 2026 | CVSS 7.1 | ClassroomIOClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course… | |
| CVE-2026-111363 | 15 Oct 2026 | CVSS 6.5 | dataelement bishengBISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other… | |
| CVE-2026-111364 | 15 Oct 2026 | CVSS 6.5 | mindoc-org MinDocMinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to… | |
| CVE-2026-111365 | 15 Oct 2026 | CVSS 6.0 | cool-team-official cool-admin-midwaycool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other… | |
| CVE-2026-111366 | 15 Oct 2026 | CVSS 7.2 | cool-team-official cool-admin-midwaycool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their… | |
| CVE-2026-111367 | 15 Oct 2026 | CVSS 6.5 | aaPanel BillionMailBillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and… | |
| CVE-2026-111368 | 15 Oct 2026 | CVSS 6.4 | ClassroomIOClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course… | |
| CVE-2026-111352 | 15 Oct 2026 | CVSS 8.8 | ThinkCMFThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to… | |
| CVE-2026-111353 | 15 Oct 2026 | CVSS 4.3 | Peppermint-Lab peppermintPeppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as… | |
| CVE-2026-111354 | 15 Oct 2026 | CVSS 3.1 | crmeb_javacrmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying… | |
| CVE-2026-111355 | 15 Oct 2026 | CVSS 6.3 | zhontai Admin.Corezhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope… | |
| CVE-2026-111356 | 15 Oct 2026 | CVSS 7.4 | magicblack MacCMSMacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over… | |
| CVE-2026-111358 | 15 Oct 2026 | CVSS 5.4 | mettle sendportal-coreSendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach… | |
| CVE-2026-111359 | 15 Oct 2026 | CVSS 7.1 | CRMEBCRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim… | |
| CVE-2026-111346 | 15 Oct 2026 | CVSS 5.4 | easysoft zentaopmsZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite… | |
| CVE-2026-111347 | 15 Oct 2026 | CVSS 5.9 | opsre go-ldap-admingo-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords… | |
| CVE-2026-111348 | 15 Oct 2026 | CVSS 5.4 | likeshopLikeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated… | |
| CVE-2026-111349 | 15 Oct 2026 | CVSS 5.3 | puemos CraftplanCraftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create… | |
| CVE-2026-111350 | 15 Oct 2026 | CVSS 5.0 | PapermarkPapermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete… | |
| CVE-2026-111351 | 15 Oct 2026 | CVSS 4.2 | metasfreshmetasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege… | |
| CVE-2026-111329 | 15 Oct 2026 | CVSS 9.8 | JuggleIMJuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the… | |
| CVE-2026-111330 | 15 Oct 2026 | CVSS 5.9 | JuggleIMJuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via… | |
| CVE-2026-111331 | 15 Oct 2026 | CVSS 6.3 | DokployDokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any… | |
| CVE-2026-111332 | 15 Oct 2026 | CVSS 3.7 | AtalayaLabs OxiCloudOxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password… | |
| CVE-2026-111343 | 15 Oct 2026 | CVSS 4.3 | pig-mesh pigpig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users'… | |
| CVE-2026-111344 | 15 Oct 2026 | CVSS 4.3 | apitableAPITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other… | |
| CVE-2026-111345 | 15 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying… | |
| CVE-2026-111312 | 15 Oct 2026 | CVSS 7.7 | OpenHealthForAll OpenHealthOpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE… | |
| CVE-2026-111313 | 15 Oct 2026 | CVSS 6.5 | DaKheera47 JobOpsJobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated… | |
| CVE-2026-111320 | 15 Oct 2026 | CVSS 6.5 | ValueCell-ai ValueCellValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend… | |
| CVE-2026-111321 | 15 Oct 2026 | CVSS 5.4 | TaskingAITaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary… | |
| CVE-2026-111322 | 15 Oct 2026 | CVSS 9.8 | coleam00 ArchonArchon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API… | |
| CVE-2026-111323 | 15 Oct 2026 | CVSS 5.3 | samugit83 RedAmonRedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because… | |
| CVE-2026-111324 | 15 Oct 2026 | CVSS 5.3 | lejianwen rustdesk-apirustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by… | |
| CVE-2026-111279 | 15 Oct 2026 | CVSS 7.5 | dragonflydb dragonflyDragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a… | |
| CVE-2026-111280 | 15 Oct 2026 | CVSS 7.4 | davenardella snap7snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow… | |
| CVE-2026-111281 | 15 Oct 2026 | CVSS 9.8 | Jooan JA-A12Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated… | |
| CVE-2026-111282 | 15 Oct 2026 | CVSS 8.2 | driftregion iso14229Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the… | |
| CVE-2026-111283 | 15 Oct 2026 | CVSS 9.0 | BMC Helix Network ManagementBMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to… | |
| CVE-2026-111284 | 15 Oct 2026 | CVSS 5.4 | Webkul Aureus ERPAureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts… | |
| CVE-2026-111272 | 15 Oct 2026 | CVSS 5.5 | LibRawLibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo… | |
| CVE-2026-111273 | 15 Oct 2026 | CVSS 6.1 | selmf unarrunarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name()… | |
| CVE-2026-111274 | 15 Oct 2026 | CVSS 5.5 | selmf unarrunarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field… | |
| CVE-2026-111275 | 15 Oct 2026 | CVSS 6.1 | NIFTI-Imaging nifti_clibnifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0]… | |
| CVE-2026-111277 | 15 Oct 2026 | CVSS 7.5 | nivocartNivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers… | |
| CVE-2026-111278 | 15 Oct 2026 | CVSS 5.3 | nivocartNivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected… | |
| CVE-2026-110917 | 15 Oct 2026 | CVSS 4.3 | Google ChromeMemory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security… | |
| CVE-2026-110918 | 15 Oct 2026 | CVSS 4.3 | Google ChromeMemory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. (Chromium… | |
| CVE-2026-110919 | 15 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-110920 | 15 Oct 2026 | CVSS 8.8 | Google ChromeMemory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-110921 | 15 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-110922 | 15 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | |
| CVE-2026-111269 | 15 Oct 2026 | CVSS 6.1 | libicallibical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input… | |
| CVE-2026-111270 | 15 Oct 2026 | CVSS 6.1 | Konstanty Bialkowski libmodpluglibmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked… | |
| CVE-2026-111271 | 15 Oct 2026 | CVSS 5.5 | Konstanty Bialkowski libmodpluglibmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers… | |
| CVE-2026-110913 | 15 Oct 2026 | CVSS 8.8 | Google ChromeMemory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-110914 | 15 Oct 2026 | CVSS 8.8 | Google ChromeMemory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the… | |
| CVE-2026-110915 | 15 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a… | |
| CVE-2026-110916 | 15 Oct 2026 | CVSS 9.6 | Google ChromeImproper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside… | |
| CVE-2024-58397 | 15 Oct 2026 | CVSS 6.1 | enzo1982 mp4v2MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via… | |
| CVE-2026-111357 | 15 Oct 2026 | CVSS 7.0 | Ivanti Connect SecureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation… | |
| CVE-2026-109468 | 15 Oct 2026 | CVSS 7.5 | Microsoft Visual Studio 2022 version 17.14Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-108453 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108454 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseBuffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108455 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108445 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108446 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108447 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108448 | 15 Oct 2026 | CVSS 7.5 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108449 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108450 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108451 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseNumeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108452 | 15 Oct 2026 | CVSS 8.8 | Microsoft SharePoint Server Subscription EditionImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-108436 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseOut-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108437 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108438 | 15 Oct 2026 | CVSS 6.5 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-108439 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108440 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108441 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108442 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108443 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseOff-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108444 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108428 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108429 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108430 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108431 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseStack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108432 | 15 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
Page 46 of 168