[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-102196 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102197 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102198 | 13 Oct 2026 | CVSS 5.3 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network. | Fix |
| CVE-2026-102199 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-102187 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-102188 | 13 Oct 2026 | CVSS 6.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | Fix |
| CVE-2026-102189 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102191 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102192 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows Server 2019Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-102193 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-100219 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 11 version 23H2Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100220 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100222 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100225 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-102186 | 13 Oct 2026 | CVSS 4.7 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. | Fix |
| CVE-2026-100211 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-100212 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100214 | 13 Oct 2026 | CVSS 8.8 | Microsoft Dynamics NAV 2017Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. | |
| CVE-2026-100215 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | Fix |
| CVE-2026-100216 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-100217 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-100218 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100202 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100203 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-100205 | 13 Oct 2026 | CVSS 7.1 | Microsoft Windows Sysinternals Process MonitorUntrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-100207 | 13 Oct 2026 | CVSS 7.3 | Microsoft Azure CycleCloud 8.9.1Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to… | Fix |
| CVE-2026-100209 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-100210 | 13 Oct 2026 | CVSS 8.8 | Microsoft 365 Apps for EnterpriseHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-100133 | 13 Oct 2026 | CVSS 9.3 | Adobe CommerceAdobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into… | |
| CVE-2026-100200 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 version 23H2Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-100201 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-92892 | 13 Oct 2026 | CVSS 9.0 | jfrog-cliPotential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected versions now include JFrog CLI v2.127.0. For… | |
| CVE-2026-93294 | 13 Oct 2026 | CVSS 6.3 | Grafana EnterpriseA user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs… | |
| CVE-2026-95502 | 13 Oct 2026 | CVSS 5.3 | Grafana NanogitA Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed… | |
| CVE-2026-52394 | 13 Oct 2026 | CVSS 9.1 | VulnerabilityDeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. | |
| CVE-2026-15577 | 13 Oct 2026 | CVSS 6.5 | Grafana EnterpriseA user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status… | |
| CVE-2026-23705 | 13 Oct 2026 | CVSS 7.2 | Fortinet FortiAnalyzerAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-23706 | 13 Oct 2026 | CVSS 6.5 | Fortinet FortiAnalyzer CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-23707 | 13 Oct 2026 | CVSS 7.2 | Fortinet FortiManager CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-33374 | 13 Oct 2026 | CVSS 6.5 | Grafana EnterpriseThe Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory… | |
| CVE-2026-37107 | 13 Oct 2026 | CVSS 9.8 | VulnerabilityAn issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component | |
| CVE-2026-108379 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108380 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108381 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108382 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108383 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108384 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108385 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108375 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108376 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108377 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-108378 | 13 Oct 2026 | CVSS 8.8 | marcosschroh dataclasses-avroschemadataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro… | |
| CVE-2026-106176 | 13 Oct 2026 | CVSS 3.8 | Fortinet FortiSIEMA missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted… | |
| CVE-2026-106170 | 13 Oct 2026 | CVSS 4.9 | Fortinet FortiSandboxAn Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6… | Fix |
| CVE-2026-106171 | 13 Oct 2026 | CVSS 6.1 | Fortinet FortiManagerA improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0… | Fix |
| CVE-2026-106172 | 13 Oct 2026 | CVSS 5.3 | Fortinet FortiSandboxA use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4… | Fix |
| CVE-2026-106173 | 13 Oct 2026 | CVSS 9.8 | Fortinet FortiSIEMA improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to… | |
| CVE-2026-106175 | 13 Oct 2026 | CVSS 2.3 | Fortinet FortiSwitchA Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions… | Fix |
| CVE-2026-105445 | 13 Oct 2026 | CVSS 9.4 | Docker HubAn Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to… | |
| CVE-2025-57739 | 13 Oct 2026 | CVSS 8.8 | Fortinet FortiMailAn improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail… | |
| CVE-2026-104085 | 13 Oct 2026 | CVSS 8.8 | odt2spipodt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands… | |
| CVE-2025-46773 | 13 Oct 2026 | CVSS 8.8 | Fortinet FortiAnalyzer CloudAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet… | Fix |
| CVE-2026-94603 | 13 Oct 2026 | CVSS 10.0 | Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationPodman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the… | Fix |
| CVE-2026-88833 | 13 Oct 2026 | CVSS 6.5 | Red Hat Hardened ImagesA flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an… | |
| CVE-2026-88834 | 13 Oct 2026 | CVSS 3.7 | Red Hat Hardened ImagesA flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain… | |
| CVE-2026-88838 | 13 Oct 2026 | CVSS 5.5 | Red Hat Hardened ImagesA flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask… | |
| CVE-2026-82416 | 13 Oct 2026 | CVSS 7.7 | FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleFrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the… | Fix |
| CVE-2026-85733 | 13 Oct 2026 | CVSS 5.3 | php frankenphpFrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default… | |
| CVE-2026-85990 | 13 Oct 2026 | CVSS 8.8 | Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsLeantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces… | Fix |
| CVE-2026-77459 | 13 Oct 2026 | CVSS 9.9 | Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Argo CD creates… | Fix |
| CVE-2026-78799 | 13 Oct 2026 | CVSS 9.8 | VulnerabilityDirectory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise… | |
| CVE-2026-69226 | 13 Oct 2026 | CVSS 6.5 | Esri Portal for ArcGISA flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account… | |
| CVE-2026-69227 | 13 Oct 2026 | CVSS 9.8 | Esri Portal for ArcGISA flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable… | |
| CVE-2026-66057 | 13 Oct 2026 | CVSS 5.1 | frappeFrappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state… | |
| CVE-2026-55562 | 13 Oct 2026 | CVSS 9.0 | jhuckaby CronicleCronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in… | |
| CVE-2026-55823 | 13 Oct 2026 | CVSS 8.7 | frappeFrappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated… | |
| CVE-2026-61642 | 13 Oct 2026 | CVSS 7.7 | squid-cache squidSquid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a… | |
| CVE-2026-53562 | 13 Oct 2026 | CVSS 8.5 | Citrix UniconOSImproper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and… | Fix |
| CVE-2026-54454 | 13 Oct 2026 | CVSS 9.1 | OpenCATSOpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import… | |
| CVE-2026-54640 | 13 Oct 2026 | CVSS 7.6 | openremoteOpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in… | |
| CVE-2026-54641 | 13 Oct 2026 | CVSS 7.7 | openremoteOpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in… | |
| CVE-2026-55183 | 13 Oct 2026 | CVSS 9.6 | Zarestia-Dev rclone-managerRClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts… | |
| CVE-2026-19940 | 13 Oct 2026 | CVSS 6.5 | zephyrproject zephyrThe Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in… | |
| CVE-2026-19939 | 13 Oct 2026 | CVSS 6.3 | zephyrproject zephyrThe AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request… | |
| CVE-2026-110125 | 13 Oct 2026 | CVSS 6.3 | wayn111 waynboot-mallWaynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other… | |
| CVE-2026-110126 | 13 Oct 2026 | CVSS 5.4 | wayn111 waynboot-mallwaynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to… | |
| CVE-2026-110127 | 13 Oct 2026 | CVSS 4.3 | wayn111 waynboot-mallwaynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members… | |
| CVE-2026-110128 | 13 Oct 2026 | CVSS 7.5 | fushengqian fuintfuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order… | |
| CVE-2026-110129 | 13 Oct 2026 | CVSS 6.5 | fushengqian fuintCateringfuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint… | |
| CVE-2026-110131 | 13 Oct 2026 | CVSS 5.3 | LiuYuYang01 ThriveX-ServerThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows… | |
| CVE-2026-110124 | 13 Oct 2026 | CVSS 8.1 | kerwincui FastBeeFastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to… | |
| CVE-2026-110118 | 13 Oct 2026 | CVSS 6.5 | risesoft-y9 WorkFlow-EngineWorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users'… | |
| CVE-2026-110119 | 13 Oct 2026 | CVSS 7.1 | guchengwuyue yshopmallYshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to… | |
| CVE-2026-110120 | 13 Oct 2026 | CVSS 5.4 | guchengwuyue yshopmallYshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access… | |
| CVE-2026-110121 | 13 Oct 2026 | CVSS 6.5 | PickMall lilishopPickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's… | |
| CVE-2026-110122 | 13 Oct 2026 | CVSS 4.3 | PickMall lilishopPickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores'… | |
| CVE-2026-110123 | 13 Oct 2026 | CVSS 7.1 | makunet maku-bootMakunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS… | |
| CVE-2026-110109 | 13 Oct 2026 | CVSS 6.5 | JetLinks CommunityJetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to… | |
| CVE-2026-110110 | 13 Oct 2026 | CVSS 4.3 | JetLinks CommunityJetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any… | |
| CVE-2026-110113 | 13 Oct 2026 | CVSS 4.3 | Sanluan PublicCMSPublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that… |
Page 77 of 168