[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-17475 | 12 Oct 2026 | CVSS 7.1 | IBM Planning AnalyticsIBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to… | Fix |
| CVE-2026-18541 | 12 Oct 2026 | CVSS 5.4 | IBM Planning AnalyticsIBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary… | Fix |
| CVE-2026-19620 | 12 Oct 2026 | CVSS 8.8 | IBM Planning AnalyticsIBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. | Fix |
| CVE-2026-109672 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109673 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are… | |
| CVE-2026-109674 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation… | |
| CVE-2026-109675 | 12 Oct 2026 | CVSS 4.3 | frappe suiteFrappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota… | |
| CVE-2026-109666 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109667 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the… | |
| CVE-2026-109668 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records… | |
| CVE-2026-109669 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109670 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered… | |
| CVE-2026-109671 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered… | |
| CVE-2026-109660 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that… | |
| CVE-2026-109661 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109662 | 12 Oct 2026 | CVSS 6.1 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts… | |
| CVE-2026-109663 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints… | |
| CVE-2026-109664 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role to… | |
| CVE-2026-109665 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109654 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that… | |
| CVE-2026-109655 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109656 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109657 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a… | |
| CVE-2026-109658 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109659 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109648 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109649 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109650 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109651 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable… | |
| CVE-2026-109652 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields… | |
| CVE-2026-109653 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability because record fields are rendered into… | |
| CVE-2026-109643 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail… | |
| CVE-2026-109644 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109645 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109646 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109647 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input… | |
| CVE-2026-109637 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their… | |
| CVE-2026-109638 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation… | |
| CVE-2026-109639 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109640 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints… | |
| CVE-2026-109641 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109642 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109632 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109633 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-site scripting vulnerability because content submitted through a… | |
| CVE-2026-109634 | 12 Oct 2026 | CVSS 4.9 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation… | |
| CVE-2026-109635 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that… | |
| CVE-2026-109636 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce… | |
| CVE-2026-109626 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated… | |
| CVE-2026-109627 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109628 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109629 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email… | |
| CVE-2026-109630 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109631 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing… | |
| CVE-2026-109617 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109621 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling… | |
| CVE-2026-109622 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109623 | 12 Oct 2026 | CVSS 5.4 | frappe erpnextFrappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109624 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109625 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109612 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored… | |
| CVE-2026-109613 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109614 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their… | |
| CVE-2026-109615 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109616 | 12 Oct 2026 | CVSS 7.1 | frappe erpnextFrappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce… | |
| CVE-2026-109603 | 12 Oct 2026 | CVSS 3.3 | frappeFrappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling… | |
| CVE-2026-109604 | 12 Oct 2026 | CVSS 7.3 | frappe erpnextFrappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored… | |
| CVE-2026-109608 | 12 Oct 2026 | CVSS 8.8 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any… | |
| CVE-2026-109609 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation… | |
| CVE-2026-109610 | 12 Oct 2026 | CVSS 6.5 | frappe erpnextFrappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce… | |
| CVE-2026-109611 | 12 Oct 2026 | CVSS 4.3 | frappe erpnextFrappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce… | |
| CVE-2026-109596 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets malicious themes or modules expose files outside… | |
| CVE-2026-109597 | 12 Oct 2026 | CVSS 5.4 | gohugoio hugoHugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows Markdown content authors to inject HTML by… | |
| CVE-2026-109598 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint… | |
| CVE-2026-109599 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper… | |
| CVE-2026-109600 | 12 Oct 2026 | CVSS 5.3 | frappeFrappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email… | |
| CVE-2026-109601 | 12 Oct 2026 | CVSS 6.5 | frappeFrappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing… | |
| CVE-2026-109602 | 12 Oct 2026 | CVSS 5.4 | frappeFrappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders… | |
| CVE-2026-108937 | 12 Oct 2026 | CVSS 5.3 | code-projects Online Ticket Reservation SystemA vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file… | |
| CVE-2026-108938 | 12 Oct 2026 | CVSS 5.3 | code-projects Matrimonial SystemA flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This… | |
| CVE-2026-109572 | 12 Oct 2026 | CVSS 7.6 | open-webuiOpen WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the… | |
| CVE-2026-109573 | 12 Oct 2026 | CVSS 8.1 | thorsten phpMyFAQphpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated… | |
| CVE-2026-109574 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project… | |
| CVE-2026-109595 | 12 Oct 2026 | CVSS 5.5 | gohugoio hugoHugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project… | |
| CVE-2026-108935 | 12 Oct 2026 | CVSS 2.4 | Edimax BR-6208ACA weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formPortFw of the… | |
| CVE-2026-108936 | 12 Oct 2026 | CVSS 2.4 | Edimax BR-6208ACA security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS… | |
| CVE-2025-71431 | 12 Oct 2026 | CVSS 5.3 | frappeFrappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied… | |
| CVE-2025-71432 | 12 Oct 2026 | CVSS 8.1 | frappe erpnextFrappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a… | |
| CVE-2026-102627 | 12 Oct 2026 | CVSS 8.8 | IBM TRIRIGA Application PlatformIBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation… | |
| CVE-2024-58390 | 12 Oct 2026 | CVSS 8.8 | frappeFrappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that… | |
| CVE-2024-58391 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped… | |
| CVE-2025-71430 | 12 Oct 2026 | CVSS 5.4 | frappeFrappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are… | |
| CVE-2023-54407 | 12 Oct 2026 | CVSS 4.9 | frappeFrappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local… | |
| CVE-2023-54408 | 12 Oct 2026 | CVSS 6.1 | frappeFrappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in… | |
| CVE-2023-54409 | 12 Oct 2026 | CVSS 4.8 | frappeFrappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user… | |
| CVE-2023-54410 | 12 Oct 2026 | CVSS 4.3 | frappeFrappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing… | |
| CVE-2023-54411 | 12 Oct 2026 | CVSS 5.9 | frappeFrappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other… | |
| CVE-2023-54412 | 12 Oct 2026 | CVSS 6.5 | frappeFrappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any… | |
| CVE-2023-54406 | 12 Oct 2026 | CVSS 4.9 | frappeFrappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server… | |
| CVE-2026-84312 | 12 Oct 2026 | CVSS 7.1 | Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant… | |
| CVE-2026-90911 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo AI ServiceIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
Page 83 of 168