[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-61931 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-62687 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally. | |
| CVE-2026-62879 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally. | |
| CVE-2026-66822 | 13 Oct 2026 | CVSS 5.9 | Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information DisclosureInsertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. | Fix |
| CVE-2026-68836 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-49785 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-54086 | 13 Oct 2026 | CVSS 5.3 | esa sleapi-jSLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an… | |
| CVE-2026-58280 | 13 Oct 2026 | CVSS 7.5 | Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of ServiceUncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-59116 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a… | |
| CVE-2026-110238 | 13 Oct 2026 | CVSS 8.8 | zofe rapyd-adminRapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default… | |
| CVE-2026-110239 | 13 Oct 2026 | CVSS 4.4 | zofe rapyd-adminRapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model… | |
| CVE-2026-110240 | 13 Oct 2026 | CVSS 4.8 | duke-git lancetLancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and… | |
| CVE-2026-110247 | 13 Oct 2026 | CVSS 8.4 | Mozilla ThunderbirdSeveral buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth… | |
| CVE-2026-110249 | 13 Oct 2026 | CVSS 8.6 | Mozilla ThunderbirdA malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough… | |
| CVE-2026-110254 | 13 Oct 2026 | CVSS 4.3 | Finsys dockhandFinsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts… | |
| CVE-2026-110255 | 13 Oct 2026 | CVSS 8.5 | Finsys dockhandFinsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the… | |
| CVE-2026-110256 | 13 Oct 2026 | CVSS 3.7 | Finsys dockhandFinsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the… | |
| CVE-2026-110231 | 13 Oct 2026 | CVSS 4.7 | muCommandermuCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by… | |
| CVE-2026-110232 | 13 Oct 2026 | CVSS 3.3 | Fossify File ManagerFossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction… | |
| CVE-2026-110233 | 13 Oct 2026 | CVSS 7.8 | NSPC911 rovrRovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file… | |
| CVE-2026-110234 | 13 Oct 2026 | CVSS 4.4 | elio-fm elioElio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating… | |
| CVE-2026-110235 | 13 Oct 2026 | CVSS 5.5 | Abdurazaaq Mohammed MP ManagerMP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the… | |
| CVE-2026-110236 | 13 Oct 2026 | CVSS 7.0 | KDE DolphinKDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted… | |
| CVE-2026-110237 | 13 Oct 2026 | CVSS 7.3 | vifmVifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to… | |
| CVE-2026-110224 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias… | |
| CVE-2026-110225 | 13 Oct 2026 | CVSS 2.7 | ShaarliShaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal… | |
| CVE-2026-110226 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under… | |
| CVE-2026-110228 | 13 Oct 2026 | CVSS 5.4 | wallabagwallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by… | |
| CVE-2026-110229 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to… | |
| CVE-2026-110230 | 13 Oct 2026 | CVSS 5.4 | sergix44 XBackBoneXBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via… | |
| CVE-2026-110218 | 13 Oct 2026 | CVSS 3.7 | Webkul Aureus ERPAureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts… | |
| CVE-2026-110219 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price… | |
| CVE-2026-110220 | 13 Oct 2026 | CVSS 7.1 | Kubeflow Model RegistryKubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller… | |
| CVE-2026-110221 | 13 Oct 2026 | CVSS 5.4 | Webkul QloAppsQloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes… | |
| CVE-2026-110222 | 13 Oct 2026 | CVSS 5.3 | Razorpay IFSCRazorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by… | |
| CVE-2026-110223 | 13 Oct 2026 | CVSS 3.1 | Kareadita KavitaKavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist… | |
| CVE-2026-110211 | 13 Oct 2026 | CVSS 8.1 | iflytek skillhubiFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users'… | |
| CVE-2026-110212 | 13 Oct 2026 | CVSS 4.3 | Stonewuu ai-fusion-videoStonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the… | |
| CVE-2026-110213 | 13 Oct 2026 | CVSS 4.3 | Stonewuu ai-fusion-videoStonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other… | |
| CVE-2026-110214 | 13 Oct 2026 | CVSS 3.7 | xiaonuobase SnowySnowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the… | |
| CVE-2026-110215 | 13 Oct 2026 | CVSS 8.8 | youlaitech youlai-bootyoulai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button… | |
| CVE-2026-110216 | 13 Oct 2026 | CVSS 7.1 | youlaitech youlai-bootyoulai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because… | |
| CVE-2026-110217 | 13 Oct 2026 | CVSS 6.5 | lenve vhrLenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators'… | |
| CVE-2026-110205 | 13 Oct 2026 | CVSS 8.8 | RooCodeInc Roo-CodeRoo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to *… | |
| CVE-2026-110206 | 13 Oct 2026 | CVSS 8.8 | RooCodeInc Roo-CodeRoo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell… | |
| CVE-2026-110207 | 13 Oct 2026 | CVSS 8.8 | WuKongOpenSource Wukong AICRMWukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and… | |
| CVE-2026-110208 | 13 Oct 2026 | CVSS 7.1 | WuKongOpenSource Wukong AICRMWukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to… | |
| CVE-2026-110209 | 13 Oct 2026 | CVSS 6.5 | Stonewuu ai-fusion-videoStonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored… | |
| CVE-2026-110210 | 13 Oct 2026 | CVSS 5.3 | Phase ConsolePhase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read… | |
| CVE-2026-110111 | 13 Oct 2026 | CVSS 7.5 | vatesfr xen-orchestraXen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by… | |
| CVE-2026-110112 | 13 Oct 2026 | CVSS 8.1 | Finsys dockhandDockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss… | |
| CVE-2026-110130 | 13 Oct 2026 | CVSS 10.0 | Finsys dockhandDockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset… | |
| CVE-2026-110202 | 13 Oct 2026 | CVSS 8.8 | RooCodeInc Roo-CodeRoo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell… | |
| CVE-2026-110203 | 13 Oct 2026 | CVSS 8.8 | RooCodeInc Roo-CodeRoo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing… | |
| CVE-2026-110204 | 13 Oct 2026 | CVSS 8.8 | RooCodeInc Roo-CodeRoo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because… | |
| CVE-2026-110036 | 13 Oct 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process… | |
| CVE-2026-109428 | 13 Oct 2026 | CVSS 8.8 | mistralai mistral-vibeMistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting… | |
| CVE-2026-109429 | 13 Oct 2026 | CVSS 8.8 | mistralai mistral-vibeMistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a… | |
| CVE-2026-109453 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108468 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108471 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1809Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108462 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information… | |
| CVE-2026-108463 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 11 Version 24H2Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | |
| CVE-2026-108464 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108465 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108466 | 13 Oct 2026 | CVSS 5.3 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | |
| CVE-2026-108467 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network. | |
| CVE-2026-108399 | 13 Oct 2026 | CVSS 7.2 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108400 | 13 Oct 2026 | CVSS 8.8 | Microsoft HEVC Video ExtensionsInteger overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108457 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 21H2Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108458 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108460 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-108461 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108136 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108396 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges… | |
| CVE-2026-108398 | 13 Oct 2026 | CVSS 8.8 | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | |
| CVE-2026-108130 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108131 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | |
| CVE-2026-108132 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108133 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows Server 2022Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108134 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-108135 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-107606 | 13 Oct 2026 | CVSS 6.2 | Swann Communications SWIFI-SE2KICSWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an… | |
| CVE-2026-107607 | 13 Oct 2026 | CVSS 6.2 | Swann Communications SWIFI-SE2KICSWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an… | |
| CVE-2026-108127 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-108128 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-108129 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | |
| CVE-2026-105729 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows Sysinternals Process MonitorUntrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105731 | 13 Oct 2026 | CVSS 5.5 | Microsoft Office for AndroidUse of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. | |
| CVE-2026-105732 | 13 Oct 2026 | CVSS 7.3 | Microsoft Sysinternals SuiteStack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105733 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 21H2Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | |
| CVE-2026-106625 | 13 Oct 2026 | CVSS 7.8 | Adobe FrameMaker 2026Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current… | |
| CVE-2026-107605 | 13 Oct 2026 | CVSS 6.2 | Swann Communications SWIFI-SE2KICSWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an… | |
| CVE-2026-105720 | 13 Oct 2026 | CVSS 4.3 | Microsoft SharePoint Server Subscription EditionIncorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | Fix |
| CVE-2026-105722 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105723 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-105725 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows Security AppUse after free in Windows Security App allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-105726 | 13 Oct 2026 | CVSS 5.5 | Microsoft Defender for Endpoint for WindowsOut-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally. | |
| CVE-2026-105727 | 13 Oct 2026 | CVSS 8.8 | Microsoft Dynamics NAV 2018Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to elevate… | |
| CVE-2026-105728 | 13 Oct 2026 | CVSS 7.5 | Microsoft Dynamics NAV 2018Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. |
Page 75 of 168