[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109694 | 15 Oct 2026 | CVSS 9.8 | WP ManageNinja LLC Fluent CRMIncorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation.This issue affects Fluent CRM… | |
| CVE-2026-108491 | 15 Oct 2026 | CVSS 7.1 | Everest FormsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms… | |
| CVE-2026-108497 | 15 Oct 2026 | CVSS 9.3 | TMS AmeliaImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia ameliabooking allows SQL… | |
| CVE-2026-108498 | 15 Oct 2026 | CVSS 7.1 | bannersky BSK PDF ManagerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager… | |
| CVE-2026-79829 | 15 Oct 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE NonStop HTTP WEBSERVERA security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. | |
| CVE-2026-50612 | 15 Oct 2026 | CVSS 9.4 | QNAP Systems Inc. QuMagieAn unix symbolic link (symlink) following vulnerability has been reported to affect QuMagie. If a remote attacker gains a user account, they can then… | |
| CVE-2026-50619 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. QsirchA path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents… | |
| CVE-2026-53882 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. Virtualization StationAn improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote… | |
| CVE-2026-79824 | 15 Oct 2026 | CVSS 8.0 | Hewlett Packard Enterprise HPE NonStop Python 3.xA directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in… | |
| CVE-2026-79825 | 15 Oct 2026 | CVSS 7.1 | Hewlett Packard Enterprise HPE NonStop NDSRESTA heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution address and may potentially redirect execution flow. | |
| CVE-2026-79826 | 15 Oct 2026 | CVSS 7.1 | Hewlett Packard Enterprise HPE NonStop OCAXA heap buffer overflow in HPE NonStop OCAX could corrupt address space and may potentially redirect execution flow. | |
| CVE-2026-79827 | 15 Oct 2026 | CVSS 7.1 | Hewlett Packard Enterprise HPE NonStop Inspect SubsystemA heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. | |
| CVE-2026-79828 | 15 Oct 2026 | CVSS 7.1 | Hewlett Packard Enterprise HPE NonStop Debug UtilitiesA heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow. | |
| CVE-2026-39991 | 15 Oct 2026 | CVSS 4.8 | QNAP Systems Inc. Notes Station 3A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then… | |
| CVE-2026-39997 | 15 Oct 2026 | CVSS 8.9 | QNAP Systems Inc. HybridDesk StationA missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could… | |
| CVE-2026-41541 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Qsync CentralAn unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they… | |
| CVE-2026-41545 | 15 Oct 2026 | CVSS 8.6 | QNAP Systems Inc. QuMagieA relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then… | |
| CVE-2026-44084 | 15 Oct 2026 | CVSS 7.5 | QNAP Systems Inc. Video StationAn authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could… | |
| CVE-2026-47786 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. HybridDesk StationAn OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-47790 | 15 Oct 2026 | CVSS 6.3 | QNAP Systems Inc. QuFTP ServiceA cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then… | |
| CVE-2026-26245 | 15 Oct 2026 | CVSS 8.8 | QNAP Systems Inc. Video StationA SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-34006 | 15 Oct 2026 | CVSS 9.3 | QNAP Systems Inc. sMedio DTCP MOVEA missing authentication for critical function vulnerability has been reported to affect sMedio DTCP MOVE. If exploited, the vulnerability could… | |
| CVE-2026-34007 | 15 Oct 2026 | CVSS 6.9 | QNAP Systems Inc. Notes Station 3An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-34008 | 15 Oct 2026 | CVSS 8.5 | QNAP Systems Inc. Notes Station 3An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user… | |
| CVE-2026-34009 | 15 Oct 2026 | CVSS 8.4 | QNAP Systems Inc. Notes Station 3An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator… | |
| CVE-2026-34014 | 15 Oct 2026 | CVSS 8.4 | QNAP Systems Inc. Download StationAn incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an… | |
| CVE-2026-34015 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. Video StationA path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-39989 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Download StationA server-side request forgery (SSRF) vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can… | |
| CVE-2026-18660 | 15 Oct 2026 | CVSS 8.8 | Eclipse FoundationIn Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts… | |
| CVE-2026-18662 | 15 Oct 2026 | CVSS 6.9 | Eclipse FoundationIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same… | |
| CVE-2026-19863 | 15 Oct 2026 | CVSS 9.3 | Eclipse FoundationAn unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login… | |
| CVE-2026-19864 | 15 Oct 2026 | CVSS 5.6 | Eclipse FoundationEclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext… | |
| CVE-2026-26243 | 15 Oct 2026 | CVSS 7.2 | QNAP Systems Inc. Qsync CentralA path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-26244 | 15 Oct 2026 | CVSS 8.8 | QNAP Systems Inc. Video StationA SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-18659 | 15 Oct 2026 | CVSS 6.9 | Eclipse FoundationIn Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints… | |
| CVE-2026-75559 | 15 Oct 2026 | CVSS 6.9 | Ministry of Land, Infrastructure, Transport and Tourism Vehicle Inspection Certificate Viewer (for Android)The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data… | |
| CVE-2026-76182 | 15 Oct 2026 | CVSS 6.9 | Eclipse Foundation Eclipse JettyIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where… | |
| CVE-2026-76184 | 15 Oct 2026 | CVSS 8.2 | Eclipse Foundation Eclipse JettyIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then… | |
| CVE-2026-77711 | 15 Oct 2026 | CVSS 8.2 | Eclipse Foundation Eclipse JettyWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The… | |
| CVE-2026-79823 | 15 Oct 2026 | CVSS 4.0 | Hewlett Packard Enterprise HPE NonStop EMS DistributorHPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior. | |
| CVE-2026-96614 | 15 Oct 2026 | CVSS 5.1 | GEO CORPORATION "ゲオアプリ" for Android"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the… | |
| CVE-2026-16438 | 15 Oct 2026 | CVSS 9.4 | Mitsubishi Electric Corporation GENESIS64Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior… | |
| CVE-2026-18661 | 15 Oct 2026 | CVSS 8.8 | Eclipse FoundationIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for… | |
| CVE-2026-35088 | 15 Oct 2026 | CVSS 8.2 | Slican IPxSlican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has… | |
| CVE-2026-63314 | 15 Oct 2026 | CVSS 8.7 | Slican IPxWebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input… | |
| CVE-2026-63315 | 15 Oct 2026 | CVSS 8.2 | Slican IPxWebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can… | |
| CVE-2026-72528 | 15 Oct 2026 | CVSS 5.1 | CREEMA LTD. "Handmade Marketplace App - Creema" for Android"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a… | |
| CVE-2026-104617 | 15 Oct 2026 | CVSS 5.1 | SUSE Linux Enterprise Server 16.1There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible… | |
| CVE-2026-104618 | 15 Oct 2026 | CVSS 6.2 | SUSE Linux Enterprise Server 16.1On request the `sdbootutil` script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however… | |
| CVE-2026-105271 | 15 Oct 2026 | CVSS 5.1 | GEO CORPORATION "ゲオアプリ" for Android"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the… | |
| CVE-2026-109855 | 15 Oct 2026 | CVSS 7.5 | undiciundici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when… | |
| CVE-2026-16436 | 15 Oct 2026 | CVSS 9.2 | Mitsubishi Electric Corporation GENESISWeak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions… | |
| CVE-2026-16437 | 15 Oct 2026 | CVSS 7.1 | Mitsubishi Electric Corporation GENESISWeak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions… | |
| CVE-2026-102462 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the TDS message decoder in the Vert.x MSSQL client… | |
| CVE-2026-102463 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the binary array decoder in vertx-pg-client… | |
| CVE-2026-102464 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Eclipse Vert.x MQTT (vertx-mqtt) MqttClient… | |
| CVE-2026-102466 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x MySQL client (vertx-mysql-client)… | |
| CVE-2026-102469 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains… | |
| CVE-2026-102477 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a gRPC endpoint does have a configurable per message… | |
| CVE-2026-103223 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the PostgreSQL message decoder reads the 4-byte… | |
| CVE-2026-103224 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the MySQL message decoder aggregates inbound… | |
| CVE-2024-22031 | 15 Oct 2026 | CVSS 8.5 | SUSE rancherA vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a project with… | |
| CVE-2025-23390 | 15 Oct 2026 | CVSS 6.3 | SUSE fleetA vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting… | |
| CVE-2026-101287 | 15 Oct 2026 | CVSS 9.3 | Diaple StelaAuthentication bypass vulnerability in Stela, versions prior to 1.60.1, due to the use of a cookie named “authProcess” without validating its… | |
| CVE-2026-101290 | 15 Oct 2026 | CVSS 7.5 | SICK AG Sick_Safetyscanners_Base CPP DriverA remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to… | |
| CVE-2026-102461 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the uniqueItems keyword validation uses an O(n²)… | |
| CVE-2023-32198 | 15 Oct 2026 | CVSS 8.0 | SUSE steveA vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the… | |
| CVE-2026-101309 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use… | |
| CVE-2026-101310 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an… | |
| CVE-2026-101311 | 15 Oct 2026 | CVSS 7.0 | FreeBSDThe framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync… | |
| CVE-2026-102465 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates… | |
| CVE-2026-102467 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a… | |
| CVE-2026-102475 | 15 Oct 2026 | CVSS 5.9 | Eclipse Foundation Eclipse Vert.xIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a… | |
| CVE-2026-108092 | 15 Oct 2026 | CVSS 4.3 | pr-gateway Blog2Social: Social Media Auto Post & SchedulerThe Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… | |
| CVE-2026-81534 | 15 Oct 2026 | CVSS 8.8 | ThemeHigh Email Customizer for WooCommerce (Pro)The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.9.5. This… | |
| CVE-2026-92428 | 15 Oct 2026 | CVSS 5.3 | Unknown Rede Itaú for WooCommerceThe Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's… | |
| CVE-2026-92429 | 15 Oct 2026 | CVSS 5.3 | Unknown Rede Itaú for WooCommerceThe Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's… | |
| CVE-2026-96537 | 15 Oct 2026 | CVSS 7.5 | Unknown Tutor LMSThe Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing… | |
| CVE-2026-58098 | 15 Oct 2026 | CVSS 8.4 | FreeBSDWhen semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded… | |
| CVE-2026-58099 | 15 Oct 2026 | CVSS 7.0 | FreeBSDWhen copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal… | |
| CVE-2026-58100 | 15 Oct 2026 | CVSS 7.0 | FreeBSDkqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the… | |
| CVE-2026-74920 | 15 Oct 2026 | CVSS 7.1 | Unknown Document GalleryThe Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in… | |
| CVE-2026-76668 | 15 Oct 2026 | CVSS 6.3 | Hewlett Packard Enterprise HPE NonStop KernelA security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data. | |
| CVE-2026-79821 | 15 Oct 2026 | CVSS 8.2 | Hewlett Packard Enterprise HPE NonStop SOAP 4.0A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down. | |
| CVE-2026-79822 | 15 Oct 2026 | CVSS 7.1 | Hewlett Packard Enterprise HPE NonStop TNS/X Native InspectA security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow. | |
| CVE-2026-24723 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2026-39993 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. Download StationA relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then… | |
| CVE-2026-41544 | 15 Oct 2026 | CVSS 8.7 | QNAP Systems Inc. QcalAgentA path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-19377 | 15 Oct 2026 | CVSS 6.0 | Cato Networks Cato Client for WindowsImproper certificate validation in the tunnel handshake in Cato Client allows a man-in-the-middle attacker to impersonate a Cato Point of Presence… | |
| CVE-2026-22896 | 15 Oct 2026 | CVSS 6.2 | QNAP Systems Inc. Network & Virtual SwitchA cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account… | |
| CVE-2026-24715 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. QuRouterAn observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to… | |
| CVE-2026-24718 | 15 Oct 2026 | CVSS 5.3 | QNAP Systems Inc. Qsync CentralA path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the… | |
| CVE-2026-24721 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2026-24722 | 15 Oct 2026 | CVSS 6.5 | QNAP Systems Inc. File Station 5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… | |
| CVE-2026-101308 | 15 Oct 2026 | CVSS 5.5 | FreeBSDWhen an audio channel's buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock… | Fix |
| CVE-2026-103304 | 15 Oct 2026 | CVSS 5.3 | Unknown eaSYNC BookingThe eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions… | |
| CVE-2026-103324 | 15 Oct 2026 | CVSS 5.3 | Unknown Cardinity Payment Gateway for WooCommerceThe Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it… | |
| CVE-2026-104643 | 15 Oct 2026 | CVSS 4.2 | Unknown Easy HTTPS Redirection (SSL)The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any… | |
| CVE-2026-106031 | 15 Oct 2026 | CVSS 6.5 | Unknown Spin WheelThe Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a… | |
| CVE-2026-109145 | 15 Oct 2026 | CVSS 9.8 | Unknown User Rights Access ManagerThe User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns… |
Page 50 of 168