[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110114 | 13 Oct 2026 | CVSS 6.5 | FJ-OMS oms-erpFJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search… | |
| CVE-2026-110115 | 13 Oct 2026 | CVSS 7.5 | risesoft-y9 Digital-InfrastructureRisesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream… | |
| CVE-2026-110116 | 13 Oct 2026 | CVSS 9.1 | risesoft-y9 Digital-InfrastructureRisesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows… | |
| CVE-2026-110117 | 13 Oct 2026 | CVSS 6.5 | 1024-lab SmartAdminSmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees… | |
| CVE-2026-110103 | 13 Oct 2026 | CVSS 5.4 | mlogclub bbs-gobbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the… | |
| CVE-2026-110104 | 13 Oct 2026 | CVSS 5.9 | xxyopen novelXxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because… | |
| CVE-2026-110105 | 13 Oct 2026 | CVSS 5.3 | b3log SymphonyB3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because… | |
| CVE-2026-110106 | 13 Oct 2026 | CVSS 4.2 | dromara RuoYi-Vue-PlusRuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social… | |
| CVE-2026-110107 | 13 Oct 2026 | CVSS 4.2 | dromara RuoYi-Cloud-PlusRuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users'… | |
| CVE-2026-110108 | 13 Oct 2026 | CVSS 8.1 | mateaix MateCloudMateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the… | |
| CVE-2026-10759 | 13 Oct 2026 | CVSS 5.5 | Esri Portal for ArcGISA flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries… | |
| CVE-2026-110097 | 13 Oct 2026 | CVSS 8.1 | ikaros-dev ikarosIkaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by… | |
| CVE-2026-110098 | 13 Oct 2026 | CVSS 5.4 | JoraniJorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other… | |
| CVE-2026-110099 | 13 Oct 2026 | CVSS 4.3 | JoraniJorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions… | |
| CVE-2026-110100 | 13 Oct 2026 | CVSS 5.4 | JoraniJorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into… | |
| CVE-2026-110101 | 13 Oct 2026 | CVSS 5.4 | benjaminjonard KoillectionKoillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file… | |
| CVE-2026-110102 | 13 Oct 2026 | CVSS 7.5 | romkatv powerlevel10kPowerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification… | |
| CVE-2026-109890 | 13 Oct 2026 | CVSS 5.3 | LeapWorx Premium Addons for ElementorMissing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured… | |
| CVE-2026-109896 | 13 Oct 2026 | CVSS 4.3 | WP Chill Download Monitor integration for WooCommerceMissing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows… | |
| CVE-2026-109898 | 13 Oct 2026 | CVSS 5.3 | Arraytics WP Event SolutionMissing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-109827 | 13 Oct 2026 | CVSS 6.3 | GPACA vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of… | |
| CVE-2026-109828 | 13 Oct 2026 | CVSS 4.3 | libsndfileA vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the… | |
| CVE-2026-109620 | 13 Oct 2026 | CVSS 7.3 | SourceCodester Online Reviewer SystemA vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file… | |
| CVE-2026-109606 | 13 Oct 2026 | CVSS 7.3 | SourceCodester Art Gallery Management SystemA vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::save_user of the file… | |
| CVE-2026-109607 | 13 Oct 2026 | CVSS 7.3 | SourceCodester Online Exam SystemA flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of… | |
| CVE-2026-109412 | 13 Oct 2026 | CVSS 9.9 | Ivanti Neurons Patch for IntuneAn exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. | Fix |
| CVE-2026-106034 | 13 Oct 2026 | CVSS 5.0 | Ivanti XtractionA Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary… | Fix |
| CVE-2026-106035 | 13 Oct 2026 | CVSS 5.5 | Ivanti XtractionAn Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker… | Fix |
| CVE-2026-106042 | 13 Oct 2026 | CVSS 9.9 | Ivanti XtractionAn External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect… | Fix |
| CVE-2026-106043 | 13 Oct 2026 | CVSS 7.5 | Ivanti XtractionA Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to… | Fix |
| CVE-2026-106047 | 13 Oct 2026 | CVSS 7.7 | Ivanti XtractionA Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker… | Fix |
| CVE-2026-104126 | 13 Oct 2026 | CVSS 6.0 | jumpserverJumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based… | |
| CVE-2026-104250 | 13 Oct 2026 | CVSS 6.1 | unstructured: Stored XSS via unescaped HTML generationThe unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs… | Fix |
| CVE-2026-102989 | 13 Oct 2026 | CVSS 9.3 | TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesTanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for… | Fix |
| CVE-2026-103030 | 13 Oct 2026 | CVSS 7.5 | Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the… | Fix |
| CVE-2026-96297 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerUse of freed memory in the aggregation feature of MongoDB Server can cause the server to read data from a memory area after it has been released… | Fix |
| CVE-2026-96299 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerA security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the… | Fix |
| CVE-2026-79608 | 13 Oct 2026 | CVSS 9.8 | XenThe workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this… | |
| CVE-2026-79609 | 13 Oct 2026 | CVSS 8.8 | XenXPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV guest… | |
| CVE-2026-79610 | 13 Oct 2026 | CVSS 8.8 | XenXSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet… | Fix |
| CVE-2026-79611 | 13 Oct 2026 | CVSS 5.5 | XenFor XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single… | |
| CVE-2026-81507 | 13 Oct 2026 | CVSS 6.5 | espressif esp-idfESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP… | |
| CVE-2026-55695 | 13 Oct 2026 | CVSS 9.1 | fearlessgeekmedia FearlessCMSFearlessCMS is a flat-file content management system centered on simplicity and open source. In 0.1.2b and earlier, an authenticated administrator… | |
| CVE-2026-69150 | 13 Oct 2026 | CVSS 4.3 | keepassxreboot keepassxcKeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy… | |
| CVE-2026-78802 | 13 Oct 2026 | CVSS 9.8 | VulnerabilityAn issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrary code. | |
| CVE-2026-79607 | 13 Oct 2026 | CVSS 5.5 | XenDuring Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results in an… | |
| CVE-2026-54697 | 13 Oct 2026 | CVSS 6.7 | connectbot cbsshConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, DerReader.readLength() accepts excessive… | |
| CVE-2026-54700 | 13 Oct 2026 | CVSS 6.9 | connectbot cbsshConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts… | |
| CVE-2026-55376 | 13 Oct 2026 | CVSS 8.8 | heymrun heymHeym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user who can… | |
| CVE-2026-55675 | 13 Oct 2026 | CVSS 10.0 | saltyorg docsThe Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220… | |
| CVE-2026-49264 | 13 Oct 2026 | CVSS 6.1 | Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationOAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in… | Fix |
| CVE-2026-49265 | 13 Oct 2026 | CVSS 6.8 | Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in… | Fix |
| CVE-2026-110025 | 13 Oct 2026 | CVSS 7.3 | slackero phpwcmsA flaw has been found in slackero phpwcms up to 1.9.49/1.12.3. This issue affects some unknown processing of the file… | |
| CVE-2026-109525 | 13 Oct 2026 | CVSS 7.3 | girishsaraf Online-Appointment-Booking-SystemA vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an… | |
| CVE-2026-109526 | 13 Oct 2026 | CVSS 3.3 | HBAI-Ltd Toonflow-appA vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such… | |
| CVE-2026-109605 | 13 Oct 2026 | CVSS 7.3 | SourceCodester Simple Cafe Billing SystemA security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::save_user of the file… | |
| CVE-2026-109524 | 13 Oct 2026 | CVSS 5.3 | girishsaraf Online-Appointment-Booking-SystemA vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this… | |
| CVE-2026-104005 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerA security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrite privileges could crash the… | Fix |
| CVE-2026-104935 | 13 Oct 2026 | CVSS 8.6 | Ivanti Connect Secure authentication bypass allows remote commandsAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does… | ExploitedFix |
| CVE-2026-105460 | 13 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link… | |
| CVE-2026-102981 | 13 Oct 2026 | CVSS 6.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to… | |
| CVE-2026-102982 | 13 Oct 2026 | CVSS 8.5 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A… | |
| CVE-2026-102988 | 13 Oct 2026 | CVSS 5.3 | makeplane planePlane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards… | |
| CVE-2026-103928 | 13 Oct 2026 | CVSS 9.3 | metabaseMetabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and… | |
| CVE-2026-103965 | 13 Oct 2026 | CVSS 5.4 | MongoDB ServerAn issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under… | Fix |
| CVE-2026-104004 | 13 Oct 2026 | CVSS 6.5 | MongoDB ServerMongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In some cases, this can cause the… | Fix |
| CVE-2026-101899 | 13 Oct 2026 | CVSS 6.9 | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as… | Fix |
| CVE-2026-102672 | 13 Oct 2026 | CVSS 6.7 | Electron: Local race condition in Squirrel.Mac update installation on macOSElectron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.0-beta.2… | Fix |
| CVE-2026-102699 | 13 Oct 2026 | CVSS 7.5 | Xen[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437… | |
| CVE-2026-102700 | 13 Oct 2026 | CVSS 4.7 | XenWith its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL pointer check… | Fix |
| CVE-2026-102702 | 13 Oct 2026 | CVSS 7.5 | Xen[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437… | |
| CVE-2026-102734 | 13 Oct 2026 | CVSS 5.5 | lmfit astevalasteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the default Interpreter with… | |
| CVE-2026-102832 | 13 Oct 2026 | CVSS 4.2 | JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clickedJupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until… | Fix |
| CVE-2024-34321 | 13 Oct 2026 | CVSS 6.1 | VulnerabilityProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter… | |
| CVE-2024-34323 | 13 Oct 2026 | CVSS 10.0 | VulnerabilityProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This… | |
| CVE-2024-34324 | 13 Oct 2026 | CVSS 9.1 | VulnerabilityAn issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string… | |
| CVE-2024-34326 | 13 Oct 2026 | CVSS 6.1 | VulnerabilityProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType… | |
| CVE-2024-34320 | 13 Oct 2026 | CVSS 9.8 | VulnerabilityProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. | |
| CVE-2026-97333 | 13 Oct 2026 | CVSS 7.1 | Commvault CloudQAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update… | |
| CVE-2026-97334 | 13 Oct 2026 | CVSS 8.7 | Commvault CloudThe network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to… | |
| CVE-2026-9218 | 13 Oct 2026 | CVSS 4.5 | NETGEAR CBR40Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the… | |
| CVE-2026-95114 | 13 Oct 2026 | CVSS 7.5 | Vulnerabilitylibwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause… | |
| CVE-2026-95115 | 13 Oct 2026 | CVSS 7.5 | VulnerabilityBuffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser | |
| CVE-2026-95117 | 13 Oct 2026 | Not scored yet | VulnerabilityBuffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse()… | |
| CVE-2026-95121 | 13 Oct 2026 | CVSS 7.8 | VulnerabilityAn issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4… | |
| CVE-2026-95122 | 13 Oct 2026 | CVSS 7.5 | Vulnerabilitymp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause… | |
| CVE-2026-95124 | 13 Oct 2026 | CVSS 7.5 | VulnerabilityBuffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size mismatch… | |
| CVE-2026-95127 | 13 Oct 2026 | Not scored yet | VulnerabilityAn issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | |
| CVE-2026-77093 | 13 Oct 2026 | CVSS 7.1 | Commvault CloudCvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault… | |
| CVE-2026-77094 | 13 Oct 2026 | CVSS 7.1 | Commvault CloudCvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenance release. Software customers… | |
| CVE-2026-77095 | 13 Oct 2026 | CVSS 7.1 | Commvault CloudCvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maintenance release. Update all… | |
| CVE-2026-77096 | 13 Oct 2026 | CVSS 7.7 | Commvault CloudCVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved maintenance release. Update… | |
| CVE-2026-77099 | 13 Oct 2026 | CVSS 9.3 | Commvault CloudCVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenance release. Update CVFS. | |
| CVE-2026-77100 | 13 Oct 2026 | CVSS 8.7 | Commvault CloudMediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to resolved maintenance release… | |
| CVE-2026-77375 | 13 Oct 2026 | CVSS 6.5 | SFTPGo: Denial of service via malformed SSH channel requestSFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while… | Fix |
| CVE-2026-77090 | 13 Oct 2026 | CVSS 8.7 | Commvault CloudCVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software customers upgrade to resolved… | |
| CVE-2026-65200 | 13 Oct 2026 | CVSS 3.5 | Huawei openBMCThe openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the… | |
| CVE-2026-65197 | 13 Oct 2026 | CVSS 3.1 | H3C HDM Family-A G5H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is… | |
| CVE-2026-65198 | 13 Oct 2026 | CVSS 8.6 | Huawei openUBMCHuawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable… | |
| CVE-2026-65199 | 13 Oct 2026 | CVSS 5.4 | Huawei openBMCopenUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore… |
Page 78 of 168