[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111127 | 15 Oct 2026 | CVSS 6.1 | catdoccatdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past… | |
| CVE-2026-111128 | 15 Oct 2026 | CVSS 5.5 | assimpAssimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via… | |
| CVE-2026-111129 | 15 Oct 2026 | CVSS 5.5 | assimpOpen Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's… | |
| CVE-2026-111130 | 15 Oct 2026 | CVSS 6.1 | openslideOpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions… | |
| CVE-2026-111131 | 15 Oct 2026 | CVSS 6.1 | libxmplibxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in… | |
| CVE-2026-111132 | 15 Oct 2026 | CVSS 6.1 | GNOME libgxpsGNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via… | |
| CVE-2026-111133 | 15 Oct 2026 | CVSS 6.1 | libyal libfsapfslibfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap… | |
| CVE-2026-111123 | 15 Oct 2026 | CVSS 6.1 | fluidsynthFluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying… | |
| CVE-2026-111124 | 15 Oct 2026 | CVSS 7.1 | HEASARC cfitsioCFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read… | |
| CVE-2026-111125 | 15 Oct 2026 | CVSS 7.1 | HEASARC cfitsioCFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the… | |
| CVE-2026-111126 | 15 Oct 2026 | CVSS 6.1 | catdoccatdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows… | |
| CVE-2026-110874 | 15 Oct 2026 | CVSS 6.6 | dolibarrDolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without… | |
| CVE-2026-110875 | 15 Oct 2026 | CVSS 6.1 | adplugAdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array… | |
| CVE-2026-110876 | 15 Oct 2026 | CVSS 5.5 | adplugAdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a… | |
| CVE-2026-110877 | 15 Oct 2026 | CVSS 5.5 | adplugAdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap… | |
| CVE-2026-110878 | 15 Oct 2026 | CVSS 5.4 | aureuserpAureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped… | |
| CVE-2026-110374 | 15 Oct 2026 | CVSS 4.3 | Hamid Alinia Login with phone numberMissing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-110375 | 15 Oct 2026 | CVSS 6.5 | WP Chill Download MonitorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor… | |
| CVE-2026-110378 | 15 Oct 2026 | CVSS 5.3 | WP E-Signature Ninja Forms Signature Contract Add-OnMissing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting… | |
| CVE-2026-109897 | 15 Oct 2026 | CVSS 5.4 | WP Chill Strong TestimonialsMissing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-109924 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its EventSource… | |
| CVE-2026-109932 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its WebSocket… | |
| CVE-2026-110360 | 15 Oct 2026 | CVSS 5.3 | WPdreams Ajax Search LiteMissing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-110361 | 15 Oct 2026 | CVSS 6.5 | ClikIT Infinite UploadsInsertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive… | |
| CVE-2026-110362 | 15 Oct 2026 | CVSS 5.3 | Planet studio PlanetStudio Payment GatewayMissing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly… | |
| CVE-2026-110364 | 15 Oct 2026 | CVSS 5.3 | WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerceMissing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce… | |
| CVE-2026-109689 | 15 Oct 2026 | CVSS 5.3 | WP Sunshine Sunshine Photo CartMissing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-109829 | 15 Oct 2026 | CVSS 9.1 | undiciundici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the… | |
| CVE-2026-109841 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch() implementation verifies… | |
| CVE-2026-109869 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch()… | |
| CVE-2026-109893 | 15 Oct 2026 | CVSS 6.5 | Brainstorm Force Presto PlayerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player… | |
| CVE-2026-108334 | 15 Oct 2026 | CVSS 7.4 | Red Hat Connectivity Link 1.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether… | |
| CVE-2026-108499 | 15 Oct 2026 | CVSS 5.3 | WebberZone Knowledge BaseMissing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-109131 | 15 Oct 2026 | CVSS 5.4 | Red Hat Ansible Automation Platform 2The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders… | |
| CVE-2026-109383 | 15 Oct 2026 | CVSS 9.1 | undiciundici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher… | |
| CVE-2026-108126 | 15 Oct 2026 | CVSS 6.0 | Temporal Technologies, Inc. temporal-proxytemporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the… | |
| CVE-2026-106604 | 15 Oct 2026 | CVSS 6.5 | YITH WooCommerce CompareImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare… | |
| CVE-2026-106701 | 15 Oct 2026 | CVSS 6.1 | VulnerabilityELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue. | |
| CVE-2026-105660 | 15 Oct 2026 | CVSS 6.9 | mtrudel banditImproper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.host and… | |
| CVE-2026-104828 | 15 Oct 2026 | CVSS 7.2 | htmlunit-nekoHtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without… | |
| CVE-2026-104150 | 15 Oct 2026 | CVSS 8.7 | AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityAdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by… | Fix |
| CVE-2026-104827 | 15 Oct 2026 | CVSS 7.5 | react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSreact/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses… | Fix |
| CVE-2026-102946 | 15 Oct 2026 | CVSS 9.1 | authlib joserfcjoserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4… | |
| CVE-2026-103083 | 15 Oct 2026 | CVSS 5.4 | ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & AttributesAuthorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes… | |
| CVE-2026-84731 | 15 Oct 2026 | CVSS 9.8 | Nutanix Acropolis Operating System (AOS)An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by… | |
| CVE-2026-55875 | 15 Oct 2026 | CVSS 4.3 | HeliumEdu platformHelium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL… | |
| CVE-2026-55876 | 15 Oct 2026 | CVSS 3.5 | HeliumEdu platformHelium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows… | |
| CVE-2026-61702 | 15 Oct 2026 | CVSS 5.3 | OpenPrinting cupsOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in… | Fix |
| CVE-2026-54683 | 15 Oct 2026 | CVSS 6.5 | nl-portal-backend-librariesNL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner… | |
| CVE-2026-55103 | 15 Oct 2026 | CVSS 8.6 | discourse-activity-pubDiscourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing… | |
| CVE-2026-55246 | 15 Oct 2026 | CVSS 7.8 | Tatsh bincookiebincookie is a header-only binarycookies parser. Prior to 0.1.9, bincookie_init_file() in bincookie.h allocates a buffer using the actual… | |
| CVE-2026-55414 | 15 Oct 2026 | CVSS 5.3 | nl-portal-backend-librariesNL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner… | |
| CVE-2026-55453 | 15 Oct 2026 | CVSS 3.3 | OpenPrinting cupsOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c… | Fix |
| CVE-2026-55467 | 15 Oct 2026 | CVSS 2.5 | OpenPrinting cupsOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob… | Fix |
| CVE-2026-55480 | 15 Oct 2026 | CVSS 5.7 | OpenPrinting cupsOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c… | Fix |
| CVE-2026-110381 | 15 Oct 2026 | CVSS 6.3 | NSquared Simply Schedule AppointmentsAuthorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows… | |
| CVE-2026-110888 | 15 Oct 2026 | CVSS 4.3 | Meow Apps AI EngineMissing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-110890 | 15 Oct 2026 | CVSS 6.5 | Crocoblock JetSmartFiltersImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters… | |
| CVE-2026-110891 | 15 Oct 2026 | CVSS 5.4 | WordLift Srl WordLiftMissing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-111105 | 15 Oct 2026 | CVSS 7.0 | TelegramTelegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… | |
| CVE-2026-108175 | 15 Oct 2026 | CVSS 6.5 | PluginUs.Net MDTFImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF… | |
| CVE-2026-110367 | 15 Oct 2026 | CVSS 5.3 | WPExperts APIExperts Square for WooCommerceMissing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-110371 | 15 Oct 2026 | CVSS 4.3 | WP Chill Strong TestimonialsMissing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-106706 | 15 Oct 2026 | CVSS 5.4 | VulnerabilityXXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the… | |
| CVE-2026-106707 | 15 Oct 2026 | CVSS 5.4 | VulnerabilityXXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who… | |
| CVE-2026-103936 | 15 Oct 2026 | CVSS 7.5 | libp2p js-libp2plibp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes… | |
| CVE-2026-104266 | 15 Oct 2026 | CVSS 6.5 | tinytag: Infinite loop when parsing certain M4A files containing invalid atomstinytag is a Python library for reading audio file metadata. From 2.0.0 until 2.3.0, an M4A file containing a sub-atom with a size of zero inside a… | Fix |
| CVE-2026-102740 | 15 Oct 2026 | CVSS 5.8 | AsyncHttpClient async-http-clientThe AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and… | |
| CVE-2026-103350 | 15 Oct 2026 | CVSS 5.3 | Magepeople inc. Booking and Rental ManagerImproper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager… | |
| CVE-2026-85634 | 15 Oct 2026 | CVSS 8.8 | Red Hat Fuse 7A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to… | |
| CVE-2026-78850 | 15 Oct 2026 | CVSS 5.0 | VulnerabilityAn issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component | |
| CVE-2026-78851 | 15 Oct 2026 | CVSS 6.5 | VulnerabilityDirectory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php… | |
| CVE-2026-77466 | 15 Oct 2026 | CVSS 8.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee hides the Omnipay Dummy test provider from the checkout options in… | |
| CVE-2026-77467 | 15 Oct 2026 | CVSS 7.1 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not apply an… | |
| CVE-2026-77468 | 15 Oct 2026 | CVSS 6.9 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scramble-generated OpenAPI documentation configured by… | |
| CVE-2026-77470 | 15 Oct 2026 | CVSS 8.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.7.1, the Supporter or Pro webshop POST /api/v2/Shop/Checkout/Process flow accepts an… | |
| CVE-2026-61610 | 15 Oct 2026 | CVSS 2.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::highlight… | |
| CVE-2026-61611 | 15 Oct 2026 | CVSS 7.5 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has no throttle, attempt counter, backoff, CAPTCHA… | |
| CVE-2026-61838 | 15 Oct 2026 | CVSS 8.2 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through… | |
| CVE-2026-62679 | 15 Oct 2026 | CVSS 8.9 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the… | |
| CVE-2026-57569 | 15 Oct 2026 | CVSS 2.3 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved… | |
| CVE-2026-57568 | 15 Oct 2026 | CVSS 5.7 | LycheeOrg LycheeLychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a… | |
| CVE-2026-110812 | 15 Oct 2026 | CVSS 9.9 | AWS Amazon Neptune EngineDeserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with… | |
| CVE-2026-105065 | 15 Oct 2026 | CVSS 7.1 | 8theme.com XStoreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected… | |
| CVE-2026-102631 | 15 Oct 2026 | CVSS 5.9 | Canonical authdIn authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider… | |
| CVE-2026-102527 | 15 Oct 2026 | CVSS 6.9 | Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesNuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while… | Fix |
| CVE-2026-100353 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterkin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by the fix… | Fix |
| CVE-2026-100354 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crashkin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle… | Fix |
| CVE-2026-100409 | 15 Oct 2026 | CVSS 7.5 | OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsOpenNext Cloudflare is an open Next.js adapter for Cloudflare. From 0.3.0 until 1.20.2, applications that enable enableCacheInterception, rely on… | Fix |
| CVE-2026-97712 | 15 Oct 2026 | CVSS 8.7 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does… | |
| CVE-2026-97394 | 15 Oct 2026 | CVSS 7.5 | kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemskin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without an items… | Fix |
| CVE-2026-97665 | 15 Oct 2026 | CVSS 7.1 | Sonatype Nexus Repository 3A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse… | |
| CVE-2026-97666 | 15 Oct 2026 | CVSS 6.9 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an… | |
| CVE-2026-97667 | 15 Oct 2026 | CVSS 5.1 | Sonatype Nexus Repository 3Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of… | |
| CVE-2026-95155 | 15 Oct 2026 | CVSS 7.5 | VulnerabilityFasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of… | |
| CVE-2026-92982 | 15 Oct 2026 | CVSS 8.5 | Red Hat Ansible Automation Platform 2.6A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting… | |
| CVE-2026-88753 | 15 Oct 2026 | CVSS 7.5 | VulnerabilityA Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5… | |
| CVE-2026-75505 | 15 Oct 2026 | CVSS 6.0 | espocrmEspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply… | |
| CVE-2026-63442 | 15 Oct 2026 | CVSS 8.1 | opnsense coreOPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts… | |
| CVE-2026-71490 | 15 Oct 2026 | CVSS 7.1 | opnsense coreOPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned… |
Page 48 of 168