[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-78632 | 13 Oct 2026 | CVSS 5.3 | Okta RADIUS AgentThe Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the… | |
| CVE-2026-78633 | 13 Oct 2026 | CVSS 6.5 | Okta RADIUS AgentThe Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero causes the… | |
| CVE-2026-79715 | 13 Oct 2026 | CVSS 5.5 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker… | |
| CVE-2026-75748 | 13 Oct 2026 | CVSS 7.6 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high… | |
| CVE-2026-75994 | 13 Oct 2026 | CVSS 9.6 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-75995 | 13 Oct 2026 | CVSS 8.4 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-75996 | 13 Oct 2026 | CVSS 7.5 | Adobe ColdFusion 2025ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could… | |
| CVE-2026-76001 | 13 Oct 2026 | CVSS 7.1 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker… | |
| CVE-2026-71385 | 13 Oct 2026 | CVSS 8.4 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-70189 | 13 Oct 2026 | CVSS 6.7 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | |
| CVE-2026-63171 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious… | |
| CVE-2026-65674 | 13 Oct 2026 | CVSS 8.8 | Microsoft SQL Server 2019 (GDR)Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-67625 | 13 Oct 2026 | CVSS 8.5 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | |
| CVE-2026-67626 | 13 Oct 2026 | CVSS 6.5 | Microsoft SQL Server 2022 (GDR)Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-67628 | 13 Oct 2026 | CVSS 4.9 | Microsoft SQL Server 2017 (GDR)Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-68883 | 13 Oct 2026 | CVSS 8.5 | Microsoft SQL Server 2017 (GDR)Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-62840 | 13 Oct 2026 | CVSS 7.0 | Microsoft Linux 3P (Third Party) DistrosTime-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-63156 | 13 Oct 2026 | CVSS 6.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject… | |
| CVE-2026-63157 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious… | |
| CVE-2026-63168 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist… | |
| CVE-2026-63169 | 13 Oct 2026 | CVSS 6.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages… | |
| CVE-2026-49950 | 13 Oct 2026 | CVSS 9.8 | xorbitsai xoscarXorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by… | |
| CVE-2026-34633 | 13 Oct 2026 | CVSS 7.7 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker… | |
| CVE-2026-34634 | 13 Oct 2026 | CVSS 8.6 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue… | |
| CVE-2026-14532 | 13 Oct 2026 | CVSS 4.3 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an… | |
| CVE-2026-14909 | 13 Oct 2026 | CVSS 6.5 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an… | |
| CVE-2026-19810 | 13 Oct 2026 | CVSS 5.4 | Broadcom Symantec Endpoint Detection and ResponseSymantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a… | Fix |
| CVE-2026-11713 | 13 Oct 2026 | CVSS 5.4 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0… | |
| CVE-2026-108388 | 13 Oct 2026 | CVSS 3.5 | indicoIndico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user… | |
| CVE-2026-107369 | 13 Oct 2026 | CVSS 6.1 | Auth0 nextjs-auth0The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step… | |
| CVE-2026-107370 | 13 Oct 2026 | CVSS 5.3 | auth0-lockWhen a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction… | |
| CVE-2026-107371 | 13 Oct 2026 | CVSS 5.4 | auth0.jsWhen the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token… | |
| CVE-2026-106618 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106619 | 13 Oct 2026 | CVSS 9.0 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-106620 | 13 Oct 2026 | CVSS 9.6 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could… | |
| CVE-2026-106621 | 13 Oct 2026 | CVSS 9.1 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in… | |
| CVE-2026-106622 | 13 Oct 2026 | CVSS 10.0 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue… | |
| CVE-2026-106623 | 13 Oct 2026 | CVSS 7.5 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this… | |
| CVE-2026-106624 | 13 Oct 2026 | CVSS 10.0 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in… | |
| CVE-2026-106089 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106090 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106612 | 13 Oct 2026 | CVSS 9.9 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106613 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-106614 | 13 Oct 2026 | CVSS 7.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106615 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-106616 | 13 Oct 2026 | CVSS 8.6 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system… | |
| CVE-2026-106617 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-105896 | 13 Oct 2026 | CVSS 5.5 | Adobe PhotoshopPhotoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could… | |
| CVE-2026-105897 | 13 Oct 2026 | CVSS 8.6 | Adobe ColdFusion 2025ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue… | |
| CVE-2026-105898 | 13 Oct 2026 | CVSS 8.2 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-105899 | 13 Oct 2026 | CVSS 10.0 | Adobe ColdFusion 2025ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the… | |
| CVE-2026-105900 | 13 Oct 2026 | CVSS 7.5 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit… | |
| CVE-2026-105901 | 13 Oct 2026 | CVSS 8.8 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-105903 | 13 Oct 2026 | CVSS 9.9 | Adobe ColdFusion 2025ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in… | |
| CVE-2026-105994 | 13 Oct 2026 | CVSS 7.7 | Adobe ColdFusion 2025ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could… | |
| CVE-2026-105443 | 13 Oct 2026 | CVSS 8.2 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | |
| CVE-2026-105442 | 13 Oct 2026 | CVSS 7.5 | IBM WebSphere Application ServerIBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote… | |
| CVE-2026-104346 | 13 Oct 2026 | CVSS 7.8 | Adobe PhotoshopPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-104347 | 13 Oct 2026 | CVSS 7.8 | Adobe PhotoshopPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-104348 | 13 Oct 2026 | CVSS 7.8 | Adobe PhotoshopPhotoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-104587 | 13 Oct 2026 | CVSS 5.4 | Vulnerabilityblob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of… | |
| CVE-2026-103828 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-103829 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-103821 | 13 Oct 2026 | CVSS 7.8 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-103822 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could… | |
| CVE-2026-103823 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-103824 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-103825 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could… | |
| CVE-2026-103826 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-103827 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D DesignerSubstance3D - Designer is affected by a Stack-based Buffer Overflow vulnerability that could result in an application denial-of-service. An attacker… | |
| CVE-2026-101294 | 13 Oct 2026 | CVSS 8.7 | IBM WebSphere Application Server - LibertyIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker… | |
| CVE-2026-100130 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D SamplerSubstance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could… | |
| CVE-2026-100131 | 13 Oct 2026 | CVSS 5.5 | Adobe Substance 3D SamplerSubstance3D - Sampler is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could… | |
| CVE-2026-100111 | 13 Oct 2026 | CVSS 7.8 | Adobe PhotoshopPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-100112 | 13 Oct 2026 | CVSS 7.8 | Adobe PhotoshopPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-100126 | 13 Oct 2026 | CVSS 5.5 | Adobe BridgeBridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this… | |
| CVE-2026-100127 | 13 Oct 2026 | CVSS 7.8 | Adobe BridgeBridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-100128 | 13 Oct 2026 | CVSS 7.8 | Adobe BridgeBridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-100129 | 13 Oct 2026 | CVSS 7.8 | Adobe BridgeBridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user… | |
| CVE-2026-90531 | 13 Oct 2026 | CVSS 9.6 | Adobe Experience Manager as a Cloud ServiceAdobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege… | |
| CVE-2026-90532 | 13 Oct 2026 | CVSS 10.0 | Adobe Experience Manager as a Cloud ServiceAdobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-86016 | 13 Oct 2026 | CVSS 8.2 | vnotex vnoteVNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to… | |
| CVE-2026-86022 | 13 Oct 2026 | CVSS 7.0 | vnotex vnoteVNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it… | |
| CVE-2026-83958 | 13 Oct 2026 | CVSS 5.4 | Adobe Experience Manager as a Cloud ServiceAdobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating… | |
| CVE-2026-83960 | 13 Oct 2026 | CVSS 5.4 | Adobe Experience Manager as a Cloud ServiceAdobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating… | |
| CVE-2026-83662 | 13 Oct 2026 | CVSS 9.3 | Adobe Experience Manager as a Cloud ServiceAdobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject… | |
| CVE-2026-75732 | 13 Oct 2026 | CVSS 9.9 | Adobe Experience Manager 6.5 LTSAdobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the… | |
| CVE-2026-70098 | 13 Oct 2026 | CVSS 8.8 | Microsoft Visual Studio CodeMissing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-63172 | 13 Oct 2026 | CVSS 7.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user… | |
| CVE-2026-63174 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces… | |
| CVE-2026-63154 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by… | |
| CVE-2026-63158 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt… | |
| CVE-2026-63159 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over… | |
| CVE-2026-63160 | 13 Oct 2026 | CVSS 7.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the… | |
| CVE-2026-63161 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by… | |
| CVE-2026-63162 | 13 Oct 2026 | CVSS 8.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended… | |
| CVE-2026-63163 | 13 Oct 2026 | CVSS 7.5 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated… | |
| CVE-2026-63165 | 13 Oct 2026 | CVSS 8.1 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious… | |
| CVE-2026-63146 | 13 Oct 2026 | CVSS 9.8 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the… | |
| CVE-2026-63147 | 13 Oct 2026 | CVSS 5.4 | Omnispace Agora ProjectOmnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious… |
Page 61 of 168