[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107178 | 14 Oct 2026 | CVSS 6.8 | Unknown Image Photo Gallery Final Tiles GridThe Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them… | |
| CVE-2026-107319 | 14 Oct 2026 | CVSS 4.3 | Unknown GamiPressThe GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions… | |
| CVE-2026-107320 | 14 Oct 2026 | CVSS 5.3 | Unknown GamiPressThe GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to… | |
| CVE-2026-107508 | 14 Oct 2026 | CVSS 8.6 | Unknown Ultimate MultisiteThe Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing… | |
| CVE-2026-103307 | 14 Oct 2026 | CVSS 8.6 | Unknown Walletdoc Payment Gateway for WooCommerceThe Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL… | |
| CVE-2026-104644 | 14 Oct 2026 | CVSS 6.8 | Unknown Image Photo Gallery Final Tiles GridThe Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them… | |
| CVE-2026-104751 | 14 Oct 2026 | CVSS 5.3 | Unknown Rank Math SEOThe Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing… | |
| CVE-2026-105261 | 14 Oct 2026 | CVSS 6.8 | Unknown Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change CategoriesThe Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does… | |
| CVE-2026-105969 | 14 Oct 2026 | CVSS 5.3 | Unknown CodeAtoZ B2B Suite for WooCommerceThe CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing… | |
| CVE-2026-105975 | 14 Oct 2026 | CVSS 5.3 | Unknown CamPay Shortcode Payment GatewayThe CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives… | |
| CVE-2026-106098 | 14 Oct 2026 | CVSS 5.3 | Unknown WP Data AccessThe WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only… | |
| CVE-2026-106099 | 14 Oct 2026 | CVSS 5.3 | Unknown WP Data AccessThe WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token… | |
| CVE-2026-94370 | 14 Oct 2026 | CVSS 6.5 | Qt_for_MCUsA defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the… | |
| CVE-2026-110458 | 14 Oct 2026 | CVSS 3.7 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key… | |
| CVE-2026-110459 | 14 Oct 2026 | CVSS 8.6 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain… | |
| CVE-2026-50216 | 14 Oct 2026 | CVSS 5.3 | Akamai Guardicore Platform AgentAn integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent… | |
| CVE-2026-50217 | 14 Oct 2026 | CVSS 4.7 | Akamai Guardicore Platform AgentA use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to… | |
| CVE-2026-50218 | 14 Oct 2026 | CVSS 8.5 | Akamai Guardicore Platform AgentAkamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to… | |
| CVE-2026-107153 | 14 Oct 2026 | CVSS 7.0 | Rakuten Mobile, Inc. Rakuten MiniMultiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical… | |
| CVE-2026-110457 | 14 Oct 2026 | CVSS 3.7 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key… | |
| CVE-2026-46449 | 14 Oct 2026 | CVSS 6.7 | Akamai Guardicore Platform AgentThe Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld… | |
| CVE-2026-50215 | 14 Oct 2026 | CVSS 4.4 | Akamai Guardicore Platform AgentA use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6… | |
| CVE-2026-110451 | 14 Oct 2026 | CVSS 4.3 | NixOS NixNix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is… | |
| CVE-2026-110452 | 14 Oct 2026 | CVSS 4.0 | NixOS NixThe multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be… | |
| CVE-2026-110453 | 14 Oct 2026 | CVSS 4.3 | NixOS NixNix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. | |
| CVE-2026-110454 | 14 Oct 2026 | CVSS 5.3 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal… | |
| CVE-2026-110455 | 14 Oct 2026 | CVSS 8.1 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi… | |
| CVE-2026-110456 | 14 Oct 2026 | CVSS 5.3 | Ubiquiti Inc UniFi Protect AI KeyA malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi… | |
| CVE-2026-101926 | 14 Oct 2026 | CVSS 6.5 | Hyyan WooCommerce Polylang IntegrationThe Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the… | |
| CVE-2026-103369 | 14 Oct 2026 | CVSS 6.4 | joaoromao Social Share Buttons & Analytics Plugin – GetSocial.ioThe Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response'… | |
| CVE-2026-105429 | 14 Oct 2026 | CVSS 8.0 | NetBirdImproper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0… | |
| CVE-2026-106931 | 14 Oct 2026 | CVSS 8.5 | Command injection in SiteGuard Server Edition gives root or SYSTEMSiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or… | Exploited |
| CVE-2026-110450 | 14 Oct 2026 | CVSS 8.0 | NixOS NixNix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path… | |
| CVE-2026-101924 | 14 Oct 2026 | CVSS 7.2 | ice00 NewStatPressThe NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers'… | |
| CVE-2026-97398 | 14 Oct 2026 | CVSS 7.2 | foliovision FV Flowplayer Video PlayerThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions… | |
| CVE-2026-97471 | 14 Oct 2026 | CVSS 5.3 | themefusion Avada (Fusion) BuilderThe Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the… | |
| CVE-2026-97020 | 14 Oct 2026 | CVSS 6.4 | dougwollison PO/MO EditorThe PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including… | |
| CVE-2026-96661 | 14 Oct 2026 | CVSS 7.5 | pasyuk Gmedia Photo GalleryThe Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and… | |
| CVE-2026-95807 | 14 Oct 2026 | CVSS 6.4 | foliovision FV Player 8The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and… | |
| CVE-2026-95808 | 14 Oct 2026 | CVSS 7.5 | 10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form BuilderThe Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs'… | |
| CVE-2026-95816 | 14 Oct 2026 | CVSS 7.2 | edgarrojas Smart Forms – when you need more than just a contact formThe Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString'… | |
| CVE-2026-94377 | 14 Oct 2026 | CVSS 7.2 | avisverifies Verified Reviews (Avis Vérifiés)The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions… | |
| CVE-2026-93885 | 14 Oct 2026 | CVSS 7.2 | blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto DonationsThe Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object… | |
| CVE-2026-87855 | 14 Oct 2026 | CVSS 9.8 | ntbyk JTL-Connector for WooCommerceThe JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the… | |
| CVE-2026-83592 | 14 Oct 2026 | CVSS 7.2 | doctorwp Contact Form DB for EnfoldThe Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to… | |
| CVE-2026-77114 | 14 Oct 2026 | CVSS 7.2 | danrossiter Document GalleryThe Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions… | |
| CVE-2026-78193 | 14 Oct 2026 | CVSS 7.5 | ntbyk JTL-Connector for WooCommerceThe JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions… | |
| CVE-2026-16495 | 14 Oct 2026 | CVSS 6.4 | wpdevart Countdown Timer – Widget CountdownThe Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in… | |
| CVE-2026-110449 | 14 Oct 2026 | CVSS 7.5 | NixOS NixNix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list… | |
| CVE-2026-104800 | 14 Oct 2026 | CVSS 9.8 | streetforce1 AGE-GATEThe AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)'… | |
| CVE-2026-100153 | 14 Oct 2026 | CVSS 7.2 | ice00 NewStatPressThe NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up… | |
| CVE-2026-100185 | 14 Oct 2026 | CVSS 6.4 | wpwax Directorist: AI-Powered Business Directory, Listings & Classified AdsThe Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-100193 | 14 Oct 2026 | CVSS 4.7 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in… | |
| CVE-2026-97657 | 14 Oct 2026 | CVSS 9.8 | Tyche Softwares Abandoned Cart Pro for WooCommerceThe Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in… | |
| CVE-2026-97668 | 14 Oct 2026 | CVSS 9.8 | Tyche Softwares Abandoned Cart Pro for WooCommerceThe Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions… | |
| CVE-2026-14765 | 14 Oct 2026 | CVSS 7.7 | Epic Games Unreal EngineEpic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node… | |
| CVE-2026-110002 | 14 Oct 2026 | CVSS 9.8 | snazzyplugins Snazzy Social Media FeedThe Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file… | |
| CVE-2026-110444 | 14 Oct 2026 | CVSS 8.8 | TEAMPLUS TECHNOLOGY TeamPlus MessengerTeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening… | |
| CVE-2026-110445 | 14 Oct 2026 | CVSS 8.8 | TEAMPLUS TECHNOLOGY TeamPlus MessengerTeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into… | |
| CVE-2026-110447 | 14 Oct 2026 | CVSS 9.2 | Collabora Online - Built-in CODE ServerCollabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in… | |
| CVE-2026-103422 | 14 Oct 2026 | CVSS 7.2 | ateshabaev AnyCommentThe AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6… | |
| CVE-2026-102251 | 14 Oct 2026 | CVSS 7.5 | Tyche Softwares Abandoned Cart Pro for WooCommerceThe Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up… | |
| CVE-2026-86573 | 14 Oct 2026 | CVSS 5.1 | Hitachi Disk Array Driver for AIXOut-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects… | |
| CVE-2026-86607 | 14 Oct 2026 | CVSS 4.3 | Hitachi Ops Center AdministratorInternal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator… | |
| CVE-2026-92097 | 14 Oct 2026 | CVSS 9.1 | holithemes Click to Chat – HoliThemesThe Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due… | |
| CVE-2026-93388 | 14 Oct 2026 | CVSS 9.8 | Printcart Store – Web to Print Product Designer for WooCommerceThe Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remote code… | |
| CVE-2026-82715 | 14 Oct 2026 | CVSS 7.9 | Hitachi Disk Array Driver for AIXInsecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects… | |
| CVE-2026-110392 | 14 Oct 2026 | CVSS 9.8 | Samsung Open Source QA-BoardImproper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows : OS… | |
| CVE-2026-17092 | 14 Oct 2026 | CVSS 8.1 | wpwax Directorist: AI-Powered Business Directory, Listings & Classified AdsThe Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions… | |
| CVE-2026-107652 | 14 Oct 2026 | CVSS 5.3 | arshidkv12 Database Addon for Contact Form 7 – CFDB7The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1… | |
| CVE-2026-104749 | 14 Oct 2026 | CVSS 7.5 | bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email AutomationThe Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege… | |
| CVE-2026-104767 | 14 Oct 2026 | CVSS 7.5 | davefx Membership & User Roles for WooCommerce (Automatic Role Changer)The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to… | |
| CVE-2026-104995 | 14 Oct 2026 | CVSS 8.1 | dontdream BP Profile SearchThe BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value… | |
| CVE-2026-103425 | 14 Oct 2026 | CVSS 6.4 | masaakitanaka Booking PackageThe Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including… | |
| CVE-2026-103423 | 14 Oct 2026 | CVSS 7.5 | masaakitanaka Booking PackageThe Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin… | |
| CVE-2026-108473 | 14 Oct 2026 | CVSS 8.7 | TP-Link Systems Inc. HS103 v5Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker… | |
| CVE-2026-110359 | 14 Oct 2026 | CVSS 7.8 | Hyland Desktop HostHyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the… | |
| CVE-2026-110385 | 14 Oct 2026 | CVSS 8.7 | ONLYOFFICE Document ServerA remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid… | |
| CVE-2026-92817 | 14 Oct 2026 | CVSS 8.8 | Inductive Automation IgnitionThe Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with… | |
| CVE-2026-88964 | 13 Oct 2026 | CVSS 7.1 | OpenVPNAn integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of… | |
| CVE-2026-53564 | 13 Oct 2026 | CVSS 5.1 | Citrix UniconOSVulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. | Fix |
| CVE-2026-15468 | 13 Oct 2026 | CVSS 6.9 | HYPR PasswordlessAuthorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR… | |
| CVE-2026-53563 | 13 Oct 2026 | CVSS 6.9 | Citrix UniconOSVulnerability in Citrix UniconOS leading to Persistent Command Execution This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2. | Fix |
| CVE-2026-105390 | 13 Oct 2026 | CVSS 6.9 | OpenVPN ovpn-dco-winImproper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to… | |
| CVE-2026-97381 | 13 Oct 2026 | CVSS 9.9 | LegacyUpdateLegacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin… | |
| CVE-2026-94453 | 13 Oct 2026 | CVSS 7.5 | The Libreswan Project libreswanLibreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet… | |
| CVE-2026-95632 | 13 Oct 2026 | CVSS 7.5 | Adobe Content Credentials Rust SDKCAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature… | |
| CVE-2026-95633 | 13 Oct 2026 | CVSS 7.5 | Adobe Content Credentials Rust SDKCAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature… | |
| CVE-2026-95634 | 13 Oct 2026 | CVSS 8.6 | Adobe Content Credentials Rust SDKCAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of… | |
| CVE-2026-84419 | 13 Oct 2026 | CVSS 6.8 | Citrix Workspace app for WindowsOut-of-bounds write vulnerability in Citrix Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.20 CR, before LTSR… | Fix |
| CVE-2026-84420 | 13 Oct 2026 | CVSS 5.8 | Citirx Citrix Workspace app for WindowsOut-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.20 CR… | Fix |
| CVE-2026-84790 | 13 Oct 2026 | CVSS 7.6 | OpenVPNOpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field | |
| CVE-2026-77207 | 13 Oct 2026 | CVSS 7.5 | The Libreswan Project libreswanLibreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT… | |
| CVE-2026-77205 | 13 Oct 2026 | CVSS 3.7 | The Libreswan Project libreswanLibreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result… | |
| CVE-2026-77206 | 13 Oct 2026 | CVSS 7.5 | The Libreswan Project libreswanLibreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within… | |
| CVE-2026-110170 | 13 Oct 2026 | CVSS 4.3 | Google ChromeUse after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted HTML… | |
| CVE-2026-110171 | 13 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-110172 | 13 Oct 2026 | CVSS 8.8 | Google ChromeUse after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted… | |
| CVE-2026-48377 | 13 Oct 2026 | CVSS 5.3 | Adobe Content Credentials Rust SDKCAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could… | |
| CVE-2026-48378 | 13 Oct 2026 | CVSS 5.3 | Adobe Content Credentials Rust SDKCAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could… |
Page 59 of 168