[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-76526 | 21 Oct 2026 | Not scored yet | Splunk SOARAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76527 | 21 Oct 2026 | Not scored yet | Splunk SOARAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76528 | 21 Oct 2026 | Not scored yet | Splunk SOARAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76529 | 21 Oct 2026 | Not scored yet | Splunk SOARAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76300 | 21 Oct 2026 | Not scored yet | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76301 | 21 Oct 2026 | Not scored yet | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76302 | 21 Oct 2026 | CVSS 9.9 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76303 | 21 Oct 2026 | CVSS 5.7 | Splunk SOARIn Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could store attacker-controlled content that Splunk… | |
| CVE-2026-76304 | 21 Oct 2026 | CVSS 4.3 | Splunk SOARIn Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the… | |
| CVE-2026-76305 | 21 Oct 2026 | CVSS 6.5 | Splunk SOARIn Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive of an… | |
| CVE-2026-76306 | 21 Oct 2026 | CVSS 7.5 | Splunk SOARIn Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to… | |
| CVE-2026-76307 | 21 Oct 2026 | CVSS 7.2 | Splunk SOARIn Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer… | |
| CVE-2026-76292 | 21 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a… | |
| CVE-2026-76293 | 21 Oct 2026 | CVSS 7.2 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute… | |
| CVE-2026-76294 | 21 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move… | |
| CVE-2026-76295 | 21 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user… | |
| CVE-2026-76296 | 21 Oct 2026 | CVSS 4.3 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create… | |
| CVE-2026-76297 | 21 Oct 2026 | CVSS 4.2 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the… | |
| CVE-2026-76298 | 21 Oct 2026 | CVSS 8.8 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL… | |
| CVE-2026-76299 | 21 Oct 2026 | CVSS 9.9 | Splunk EnterpriseAs part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This… | |
| CVE-2026-76287 | 21 Oct 2026 | CVSS 5.4 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or… | |
| CVE-2026-76288 | 21 Oct 2026 | CVSS 7.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk… | |
| CVE-2026-76289 | 21 Oct 2026 | CVSS 6.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the… | |
| CVE-2026-76290 | 21 Oct 2026 | CVSS 7.5 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package… | |
| CVE-2026-76291 | 21 Oct 2026 | CVSS 8.8 | Splunk EnterpriseIn Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass… | |
| CVE-2026-114439 | 21 Oct 2026 | CVSS 7.3 | oretnom23 php-travel-agency-systemA vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file… | |
| CVE-2026-114440 | 21 Oct 2026 | CVSS 7.3 | oretnom23 php-travel-agency-systemA vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of… | |
| CVE-2026-114441 | 21 Oct 2026 | CVSS 7.3 | oretnom23 php-travel-agency-systemA weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This… | |
| CVE-2026-103090 | 21 Oct 2026 | CVSS 8.8 | Google SAMMissing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status… | |
| CVE-2026-100420 | 21 Oct 2026 | CVSS 6.8 | TP-Link Systems Inc. Deco BE63 V2.0A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext… | |
| CVE-2026-91403 | 21 Oct 2026 | CVSS 9.1 | Oracle Corporation Oracle Java SEVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported… | |
| CVE-2026-94140 | 21 Oct 2026 | Not scored yet | VulnerabilityRex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no. Every… | |
| CVE-2026-94423 | 21 Oct 2026 | Not scored yet | VulnerabilityNet::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts… | |
| CVE-2026-114383 | 21 Oct 2026 | CVSS 10.0 | TOTOLINK EX200A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the… | |
| CVE-2026-114384 | 21 Oct 2026 | CVSS 6.3 | itsourcecode Online Cake Ordering SystemA security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. Affected is an unknown function of the file… | |
| CVE-2026-114501 | 21 Oct 2026 | CVSS 6.3 | python-pillow PillowPillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's rows are tightly contiguous and exports from… | |
| CVE-2026-114508 | 21 Oct 2026 | CVSS 6.5 | laravel frameworkLaravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship inclusion on a read-only endpoint can trigger a… | |
| CVE-2026-114509 | 21 Oct 2026 | CVSS 9.2 | laravel frameworkLaravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a… | |
| CVE-2026-112921 | 21 Oct 2026 | Not scored yet | VulnerabilityRobots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a… | |
| CVE-2026-114381 | 21 Oct 2026 | CVSS 6.3 | itsourcecode Online Cake Ordering SystemA vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-114382 | 21 Oct 2026 | CVSS 10.0 | TOTOLINK EX200A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of… | |
| CVE-2026-96778 | 21 Oct 2026 | CVSS 7.7 | Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a… | Fix |
| CVE-2026-96638 | 21 Oct 2026 | CVSS 6.5 | Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modePillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpImagePlugin.py permits crafted RLE BMP delta… | Fix |
| CVE-2026-96639 | 21 Oct 2026 | CVSS 9.8 | Pillow multi-frame loaders can reuse stale native image storage after mode transitionsPillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame… | Fix |
| CVE-2026-96640 | 21 Oct 2026 | CVSS 8.2 | Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a… | Fix |
| CVE-2026-96641 | 21 Oct 2026 | CVSS 6.5 | Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisePillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances against INT_MAX… | Fix |
| CVE-2026-96642 | 21 Oct 2026 | CVSS 7.1 | Pillow: TarIO negative size field causes infinite CPU-spin loopPillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a… | Fix |
| CVE-2026-96643 | 21 Oct 2026 | CVSS 7.1 | Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timePillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it… | Fix |
| CVE-2026-96644 | 21 Oct 2026 | CVSS 7.1 | Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native… | Fix |
| CVE-2026-96636 | 21 Oct 2026 | CVSS 6.5 | Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() reparse later MPO or DCX frames and replace… | Fix |
| CVE-2026-96637 | 21 Oct 2026 | CVSS 7.1 | Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSPillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and… | Fix |
| CVE-2026-82987 | 21 Oct 2026 | Not scored yet | Viewsonic vCastThere exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to… | |
| CVE-2026-29001 | 21 Oct 2026 | CVSS 7.2 | TastyIgniterTastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution… | |
| CVE-2026-114380 | 21 Oct 2026 | CVSS 6.3 | itsourcecode Online Cake Ordering SystemA vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Performing a… | |
| CVE-2026-114406 | 21 Oct 2026 | CVSS 6.8 | Red Hat Hardened ImagesThe system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates… | |
| CVE-2026-114144 | 21 Oct 2026 | CVSS 7.5 | toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decimal digit… | Fix |
| CVE-2026-114145 | 21 Oct 2026 | CVSS 7.5 | GitPython validates a submodule's ".git" path only after cloning into it (RCE)GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an… | Fix |
| CVE-2026-114377 | 21 Oct 2026 | CVSS 3.8 | leomoon-studios wiki-goA security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file… | |
| CVE-2026-114378 | 21 Oct 2026 | CVSS 6.3 | itsourcecode Online Cake Ordering SystemA vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /deleteproduct.php. The… | |
| CVE-2026-114379 | 21 Oct 2026 | CVSS 5.4 | EKKOLearnAI ekko-studioA flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file… | |
| CVE-2026-114137 | 21 Oct 2026 | CVSS 7.4 | Django REST framework: TokenProxy.delete() reports success and revokes nothingDjango REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.py uses… | Fix |
| CVE-2026-114138 | 21 Oct 2026 | CVSS 7.5 | Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationDjango REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negotiation.py… | Fix |
| CVE-2026-114139 | 21 Oct 2026 | CVSS 9.1 | Sentry-Javascript: Middleware Bypass when using Tunnel routeSentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for… | Fix |
| CVE-2026-114140 | 21 Oct 2026 | CVSS 8.8 | nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidocThe nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2… | Fix |
| CVE-2026-114141 | 21 Oct 2026 | CVSS 8.7 | toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js… | Fix |
| CVE-2026-114142 | 21 Oct 2026 | CVSS 8.8 | toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypetoml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype… | Fix |
| CVE-2026-114143 | 21 Oct 2026 | CVSS 8.7 | toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in… | Fix |
| CVE-2026-113811 | 21 Oct 2026 | Not scored yet | VulnerabilityAlgorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search. The… | |
| CVE-2026-85518 | 21 Oct 2026 | CVSS 6.1 | Red Hat Enterprise Linux 10A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path… | |
| CVE-2026-114375 | 21 Oct 2026 | CVSS 6.3 | leomoon-studios wiki-goA security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler of the file… | |
| CVE-2026-114376 | 21 Oct 2026 | CVSS 6.3 | leomoon-studios wiki-goA weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHandler of… | |
| CVE-2026-114438 | 21 Oct 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered… | |
| CVE-2026-114135 | 21 Oct 2026 | CVSS 8.8 | Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationJupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced the normal… | Fix |
| CVE-2026-114136 | 21 Oct 2026 | CVSS 7.5 | Django REST framework: JSONParser applies an attacker-named codec to the request streamDjango REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/parsers.py uses the… | Fix |
| CVE-2026-114362 | 21 Oct 2026 | CVSS 6.3 | HarnessRouterA flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test… | |
| CVE-2026-114374 | 21 Oct 2026 | CVSS 4.3 | leomoon-studios wiki-goA vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metadata_api.go… | |
| CVE-2026-111812 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own… | |
| CVE-2026-111814 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a… | |
| CVE-2026-111815 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's… | |
| CVE-2026-111817 | 21 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until… | |
| CVE-2026-112381 | 21 Oct 2026 | CVSS 5.9 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin… | |
| CVE-2026-112408 | 21 Oct 2026 | CVSS 8.1 | AWS Amazon SageMaker Python SDKMissing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2… | |
| CVE-2026-111805 | 21 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache… | |
| CVE-2026-111808 | 21 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache… | |
| CVE-2026-111809 | 21 Oct 2026 | CVSS 9.3 | Apache Software Foundation Apache Traffic ServerApache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic… | |
| CVE-2026-111810 | 21 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Traffic ServerApache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request… | |
| CVE-2026-111811 | 21 Oct 2026 | CVSS 9.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue… | |
| CVE-2026-79976 | 21 Oct 2026 | CVSS 7.1 | zephyrproject zephyrThe MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file, where the bus controller… | |
| CVE-2026-78116 | 21 Oct 2026 | CVSS 5.2 | zephyrproject zephyrThe Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In… | |
| CVE-2026-78117 | 21 Oct 2026 | CVSS 4.2 | zephyrproject zephyrThe Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet descriptor in a file-scope… | |
| CVE-2026-78118 | 21 Oct 2026 | CVSS 7.0 | zephyrproject zephyrThe kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it was called from several… | |
| CVE-2026-78119 | 21 Oct 2026 | CVSS 6.3 | zephyrproject zephyrThe Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c), taking the 12-bit length… | |
| CVE-2026-18748 | 21 Oct 2026 | CVSS 3.5 | zephyrproject zephyrThe Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field plus a fixed 8-byte… | |
| CVE-2026-19676 | 21 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object… | |
| CVE-2026-19947 | 21 Oct 2026 | CVSS 5.3 | zephyrproject zephyrThe device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and devmux_select_set(). When… | |
| CVE-2026-113870 | 21 Oct 2026 | CVSS 8.8 | MongoDB CompassMongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user… | |
| CVE-2026-114266 | 21 Oct 2026 | CVSS 6.3 | ProjectWorlds Advanced Library Management SystemA security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqli_query of the… | |
| CVE-2026-114267 | 21 Oct 2026 | CVSS 7.3 | SourceCodester Food Order Management SystemA vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The… | |
| CVE-2026-114268 | 21 Oct 2026 | CVSS 9.9 | Tenda BE3L ProA flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file… | |
| CVE-2026-114361 | 21 Oct 2026 | CVSS 5.6 | HarnessRouterA vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity… |
Page 6 of 168