[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110830 | 14 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors… | |
| CVE-2026-110831 | 14 Oct 2026 | CVSS 4.3 | FreeRDPFreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive_process_irp_create, which registers an opened local file in the… | |
| CVE-2026-110698 | 14 Oct 2026 | CVSS 6.3 | PraatA security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file… | |
| CVE-2026-110816 | 14 Oct 2026 | CVSS 5.3 | ljharb qs### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be… | |
| CVE-2026-102298 | 14 Oct 2026 | CVSS 7.5 | TP-Link System Inc. Omada Software Controller (Windows)In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a… | |
| CVE-2026-108335 | 14 Oct 2026 | CVSS 9.1 | Hitachi Vantara Remote Ops AgentWhen the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There… | |
| CVE-2026-108336 | 14 Oct 2026 | CVSS 9.1 | Hitachi Vantara Remot Ops AgentWhen the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web… | |
| CVE-2026-108337 | 14 Oct 2026 | CVSS 7.4 | Hitachi Vantara Remot Ops AgentAn administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output… | |
| CVE-2026-110695 | 14 Oct 2026 | CVSS 6.3 | turboderp ExLlamaV2A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.py of the… | |
| CVE-2026-110696 | 14 Oct 2026 | CVSS 5.3 | itsmeravitejak Online-Examination-SystemA weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an… | |
| CVE-2026-69194 | 14 Oct 2026 | CVSS 4.8 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored… | |
| CVE-2026-71854 | 14 Oct 2026 | CVSS 8.2 | OpenAEV-Platform openaevOpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to… | |
| CVE-2026-77427 | 14 Oct 2026 | CVSS 5.9 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual… | |
| CVE-2026-96540 | 14 Oct 2026 | CVSS 8.8 | SonicWall Network Security Manager (NSM)An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially… | Fix |
| CVE-2026-61844 | 14 Oct 2026 | CVSS 7.1 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical… | |
| CVE-2026-62664 | 14 Oct 2026 | CVSS 5.4 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the… | |
| CVE-2026-64856 | 14 Oct 2026 | CVSS 3.7 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise… | |
| CVE-2026-69191 | 14 Oct 2026 | CVSS 5.4 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces… | |
| CVE-2026-69193 | 14 Oct 2026 | CVSS 6.5 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed… | |
| CVE-2026-57489 | 14 Oct 2026 | CVSS 8.1 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with… | |
| CVE-2026-57490 | 14 Oct 2026 | CVSS 8.1 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has… | |
| CVE-2026-57491 | 14 Oct 2026 | CVSS 6.5 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction… | |
| CVE-2026-57492 | 14 Oct 2026 | CVSS 7.4 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or… | |
| CVE-2026-57493 | 14 Oct 2026 | CVSS 6.8 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin… | |
| CVE-2026-61843 | 14 Oct 2026 | CVSS 8.2 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled… | |
| CVE-2026-110670 | 14 Oct 2026 | CVSS 7.3 | cemtan sar2htmlA vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive… | |
| CVE-2026-110679 | 14 Oct 2026 | CVSS 7.3 | OpenSIPSA vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1. The impacted element is the function rtpproxy_offer/rtpproxy_answer of the component… | |
| CVE-2026-110689 | 14 Oct 2026 | CVSS 5.3 | OpenClaw ClawScanA security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file… | |
| CVE-2026-110694 | 14 Oct 2026 | CVSS 6.3 | OAID TengineA vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file… | |
| CVE-2026-104109 | 14 Oct 2026 | CVSS 6.8 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive… | |
| CVE-2026-104110 | 14 Oct 2026 | CVSS 5.3 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro… | |
| CVE-2026-103988 | 14 Oct 2026 | CVSS 5.4 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise… | |
| CVE-2026-104105 | 14 Oct 2026 | CVSS 6.4 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a… | |
| CVE-2026-104106 | 14 Oct 2026 | CVSS 6.5 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an… | |
| CVE-2026-104107 | 14 Oct 2026 | CVSS 6.5 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the… | |
| CVE-2026-104108 | 14 Oct 2026 | CVSS 8.1 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an… | |
| CVE-2026-103977 | 14 Oct 2026 | CVSS 8.1 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP… | |
| CVE-2026-0320 | 14 Oct 2026 | CVSS 6.1 | Palo Alto Networks Cloud NGFWA command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run… | |
| CVE-2026-100232 | 14 Oct 2026 | CVSS 7.2 | SonicWall Network Security Manager (NSM)Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in… | Fix |
| CVE-2026-0318 | 14 Oct 2026 | CVSS 4.6 | Palo Alto Networks Cloud NGFWA stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an… | |
| CVE-2026-0319 | 14 Oct 2026 | CVSS 4.9 | Palo Alto Networks Cloud NGFWAn improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to… | |
| CVE-2026-0312 | 14 Oct 2026 | CVSS 4.3 | Palo Alto Networks Checkov by Prisma CloudPath traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary… | |
| CVE-2026-0313 | 14 Oct 2026 | CVSS 6.1 | Palo Alto Networks Cortex XSOAR OS QueryA command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to… | |
| CVE-2026-0314 | 14 Oct 2026 | CVSS 4.3 | Palo Alto Networks GlobalProtect AppA type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of… | |
| CVE-2026-0315 | 14 Oct 2026 | CVSS 5.9 | Palo Alto Networks GlobalProtect AppA local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on… | |
| CVE-2026-0316 | 14 Oct 2026 | CVSS 1.1 | Palo Alto Networks Cloud NGFWA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or… | |
| CVE-2026-0317 | 14 Oct 2026 | CVSS 1.2 | Palo Alto Networks Cloud NGFWA denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a… | |
| CVE-2026-0311 | 14 Oct 2026 | CVSS 1.1 | Palo Alto Networks Checkov by Prisma CloudA server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized… | |
| CVE-2026-55679 | 14 Oct 2026 | CVSS 6.5 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before… | |
| CVE-2026-55680 | 14 Oct 2026 | CVSS 9.8 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can… | |
| CVE-2026-55681 | 14 Oct 2026 | CVSS 8.8 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit… | |
| CVE-2026-55682 | 14 Oct 2026 | CVSS 8.1 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an… | |
| CVE-2026-55683 | 14 Oct 2026 | CVSS 9.8 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts… | |
| CVE-2026-55684 | 14 Oct 2026 | CVSS 9.8 | LabRedesCefetRJ WeGIAWeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php… | |
| CVE-2026-55498 | 14 Oct 2026 | CVSS 4.8 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public… | |
| CVE-2026-55381 | 14 Oct 2026 | CVSS 7.1 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55382 | 14 Oct 2026 | CVSS 7.6 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55383 | 14 Oct 2026 | CVSS 8.2 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55384 | 14 Oct 2026 | CVSS 5.3 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55385 | 14 Oct 2026 | CVSS 6.8 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55386 | 14 Oct 2026 | CVSS 7.1 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version… | |
| CVE-2026-55387 | 14 Oct 2026 | CVSS 7.2 | InvoiceShelfInvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3… | |
| CVE-2026-54566 | 14 Oct 2026 | CVSS 8.5 | shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.29, Markdown Preview Enhanced evaluates… | |
| CVE-2026-54701 | 14 Oct 2026 | CVSS 6.9 | shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads… | |
| CVE-2026-54702 | 14 Oct 2026 | CVSS 7.3 | shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in… | |
| CVE-2026-54703 | 14 Oct 2026 | CVSS 5.8 | shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown… | |
| CVE-2026-110669 | 14 Oct 2026 | CVSS 6.5 | cemtan sar2htmlA security vulnerability has been detected in cemtan sar2html 4.0.0. This affects the function deleteHost/deleteRange/deleteAll of the file… | |
| CVE-2026-110310 | 14 Oct 2026 | CVSS 5.3 | Amazon.Extensions.S3.EncryptionA remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's… | |
| CVE-2026-110668 | 14 Oct 2026 | CVSS 7.3 | cemtan sar2htmlA weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of… | |
| CVE-2026-102980 | 14 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version… | |
| CVE-2026-102985 | 14 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the… | |
| CVE-2026-102986 | 14 Oct 2026 | CVSS 8.1 | makeplane planePlane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint… | |
| CVE-2026-0321 | 14 Oct 2026 | CVSS 6.6 | Palo Alto Networks Cloud NGFWDenial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of… | |
| CVE-2026-85714 | 14 Oct 2026 | CVSS 9.1 | Stirling-Tools Stirling-PDFStirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator… | |
| CVE-2026-82153 | 14 Oct 2026 | CVSS 2.2 | Dell OS Recovery ToolDell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with… | |
| CVE-2026-82402 | 14 Oct 2026 | CVSS 5.3 | gogsGogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the… | |
| CVE-2026-73252 | 14 Oct 2026 | CVSS 7.5 | cesanta mongooseMongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts… | |
| CVE-2026-73260 | 14 Oct 2026 | CVSS 7.5 | cesanta mongooseMongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify… | |
| CVE-2026-73261 | 14 Oct 2026 | CVSS 7.5 | cesanta mongooseMongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does… | |
| CVE-2026-63626 | 14 Oct 2026 | CVSS 8.8 | cesanta mongooseMongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without… | |
| CVE-2026-53999 | 14 Oct 2026 | CVSS 7.7 | radius-project radiusRadius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the… | |
| CVE-2026-54525 | 14 Oct 2026 | CVSS 8.8 | shd101wyy vscode-markdown-preview-enhancedMarkdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling… | |
| CVE-2026-55167 | 14 Oct 2026 | CVSS 4.2 | LDAPAccountManager lamLDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6… | |
| CVE-2026-55786 | 14 Oct 2026 | CVSS 8.4 | flytohub flyto-coreFlyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts… | |
| CVE-2026-55787 | 14 Oct 2026 | CVSS 7.1 | flytohub flyto-coreFlyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.3, validate_url_ssrf and is_private_ip in src/core/utils.py… | |
| CVE-2026-110770 | 14 Oct 2026 | CVSS 8.1 | databasusDatabasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset… | |
| CVE-2026-110771 | 14 Oct 2026 | CVSS 4.3 | ShopizerShopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by… | |
| CVE-2026-110772 | 14 Oct 2026 | CVSS 4.3 | we-promise sureSure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family… | |
| CVE-2026-110773 | 14 Oct 2026 | CVSS 4.3 | growchiefGrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users… | |
| CVE-2026-110774 | 14 Oct 2026 | CVSS 5.3 | blinkospace blinkoBlinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users'… | |
| CVE-2026-110775 | 14 Oct 2026 | CVSS 6.5 | ModelEngine-Group nexentNexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants'… | |
| CVE-2026-110763 | 14 Oct 2026 | CVSS 4.3 | zuihou lamp-bootlamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's… | |
| CVE-2026-110764 | 14 Oct 2026 | CVSS 5.3 | iflytek astron-rpaAstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows… | |
| CVE-2026-110765 | 14 Oct 2026 | CVSS 5.9 | flexpriceFlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the… | |
| CVE-2026-110766 | 14 Oct 2026 | CVSS 4.3 | colanodeColanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an… | |
| CVE-2026-110767 | 14 Oct 2026 | CVSS 7.5 | coderamp-labs gitingestGitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers… | |
| CVE-2026-110768 | 14 Oct 2026 | CVSS 4.8 | holaboss-ai holaOSholaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable… | |
| CVE-2026-110769 | 14 Oct 2026 | CVSS 8.6 | holaboss-ai holaOSholaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to… | |
| CVE-2026-110666 | 14 Oct 2026 | CVSS 6.5 | cemtan sar2htmlA vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The… | |
| CVE-2026-110667 | 14 Oct 2026 | CVSS 7.3 | cemtan sar2htmlA security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The… |
Page 52 of 168