[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-90912 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo AI ServiceIBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. | |
| CVE-2026-90920 | 12 Oct 2026 | CVSS 9.8 | IBM Maximo AI ServiceIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. | |
| CVE-2026-90921 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo AI ServiceIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper handling of malformed frames… | |
| CVE-2026-92876 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo Application Suite - IoT ComponentIBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncontrolled… | |
| CVE-2026-44828 | 12 Oct 2026 | CVSS 9.3 | QexoQexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without… | |
| CVE-2026-49483 | 12 Oct 2026 | CVSS 8.9 | codefori vscode-ibmiCode for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components… | |
| CVE-2026-49484 | 12 Oct 2026 | CVSS 5.1 | codefori vscode-ibmiCode for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1… | |
| CVE-2026-53922 | 12 Oct 2026 | CVSS 6.5 | openwrt odhcpdodhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same… | |
| CVE-2026-54459 | 12 Oct 2026 | CVSS 4.3 | error311 FileRiseFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates… | |
| CVE-2026-103658 | 12 Oct 2026 | CVSS 5.9 | GNU AspellGNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader… | |
| CVE-2026-104140 | 12 Oct 2026 | CVSS 6.1 | QGISQGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data… | |
| CVE-2026-108932 | 12 Oct 2026 | CVSS 4.3 | Netcore NR268A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the component DHCP… | |
| CVE-2026-108933 | 12 Oct 2026 | CVSS 2.4 | Edimax BR-6208ACA vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to… | |
| CVE-2026-108934 | 12 Oct 2026 | CVSS 2.4 | Edimax BR-6208ACA security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/formUrlb… | |
| CVE-2026-41210 | 12 Oct 2026 | CVSS 6.5 | moonlight-stream moonlight-qtMoonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming… | |
| CVE-2026-102596 | 12 Oct 2026 | CVSS 4.3 | NangoHQ nangoNango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a… | |
| CVE-2026-102539 | 12 Oct 2026 | CVSS 5.7 | super-productivitySuper Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync… | |
| CVE-2026-96264 | 12 Oct 2026 | CVSS 8.2 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with… | |
| CVE-2026-96265 | 12 Oct 2026 | CVSS 8.2 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with… | |
| CVE-2026-96266 | 12 Oct 2026 | CVSS 8.2 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with… | |
| CVE-2026-97691 | 12 Oct 2026 | CVSS 4.3 | get-convex convex-backendConvex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local… | |
| CVE-2026-92116 | 12 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache AlluraOAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to… | |
| CVE-2026-92119 | 12 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache AlluraREST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to… | |
| CVE-2026-92120 | 12 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache AlluraOAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to… | |
| CVE-2026-96261 | 12 Oct 2026 | CVSS 7.3 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with… | |
| CVE-2026-96262 | 12 Oct 2026 | CVSS 8.2 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with… | |
| CVE-2026-96263 | 12 Oct 2026 | CVSS 8.2 | IBM PowerVM HypervisorIBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability… | |
| CVE-2026-84316 | 12 Oct 2026 | CVSS 8.8 | Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks… | Fix |
| CVE-2026-84317 | 12 Oct 2026 | CVSS 8.8 | Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control… | Fix |
| CVE-2026-84318 | 12 Oct 2026 | CVSS 8.8 | Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCENginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration… | Fix |
| CVE-2026-84319 | 12 Oct 2026 | CVSS 8.3 | Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives… | Fix |
| CVE-2026-84320 | 12 Oct 2026 | CVSS 6.3 | Nginx UI: Auto backup name allows path traversal outside validated storage pathNginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but… | Fix |
| CVE-2026-84321 | 12 Oct 2026 | CVSS 5.4 | Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long… | Fix |
| CVE-2026-84360 | 12 Oct 2026 | CVSS 8.1 | Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but… | Fix |
| CVE-2026-75881 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo Application Suite - IoT ComponentIBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite… | |
| CVE-2026-78673 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo AI ServiceIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. | |
| CVE-2026-84313 | 12 Oct 2026 | CVSS 8.8 | Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered… | Fix |
| CVE-2026-84314 | 12 Oct 2026 | CVSS 8.7 | Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated… | Fix |
| CVE-2026-84315 | 12 Oct 2026 | CVSS 8.3 | Nginx UI OTP secure-session step-up is missing on sensitive mutation routesNginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated… | Fix |
| CVE-2026-41504 | 12 Oct 2026 | CVSS 5.8 | Coraza: Native audit-log format allows CRLF injection and log forgery via request body and header fieldsOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in… | Fix |
| CVE-2026-41508 | 12 Oct 2026 | CVSS 5.8 | Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handlingOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in… | Fix |
| CVE-2026-53997 | 12 Oct 2026 | CVSS 7.4 | NetHerman Portal del Hermano (portaldelhermano.es)Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at… | |
| CVE-2026-18513 | 12 Oct 2026 | CVSS 7.2 | IBM Maximo Application Suite - Location Service for Esri ComponentIBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less… | |
| CVE-2026-18517 | 12 Oct 2026 | CVSS 7.7 | IBM Maximo Application Suite - Location Service for Esri ComponentIBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Application Suite — Location Service for Esri… | |
| CVE-2026-18529 | 12 Oct 2026 | CVSS 8.7 | IBM Maximo Application Suite - Location Service for Esri ComponentIBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation… | |
| CVE-2026-18533 | 12 Oct 2026 | CVSS 6.5 | IBM Maximo Application Suite - Location Service for Esri ComponentIBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised… | |
| CVE-2026-18537 | 12 Oct 2026 | CVSS 8.7 | IBM Maximo Application Suite - Location Service for Esri ComponentIBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised… | |
| CVE-2026-16678 | 12 Oct 2026 | CVSS 4.5 | IBM Virtualization Management InterfaceIBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote… | |
| CVE-2026-109565 | 12 Oct 2026 | CVSS 6.1 | zofe rapyd-adminRapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts… | |
| CVE-2026-109566 | 12 Oct 2026 | CVSS 9.8 | zofe rapyd-adminRapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin… | |
| CVE-2026-109567 | 12 Oct 2026 | CVSS 7.2 | zofe rapyd-adminRapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users… | |
| CVE-2026-109568 | 12 Oct 2026 | CVSS 7.1 | MarceauKa ShaarkShaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership… | |
| CVE-2026-109569 | 12 Oct 2026 | CVSS 8.8 | Th0rgal sandboxed.shsandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because… | |
| CVE-2026-109570 | 12 Oct 2026 | CVSS 4.3 | Fire-Boltt BSW013Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject… | |
| CVE-2026-109571 | 12 Oct 2026 | CVSS 4.3 | Fire-Boltt BSW013Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired BLE devices to subscribe to… | |
| CVE-2026-109559 | 12 Oct 2026 | CVSS 8.7 | tianma-if EdgeEverEdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via… | |
| CVE-2026-109560 | 12 Oct 2026 | CVSS 7.5 | continuedev continueContinue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by… | |
| CVE-2026-109561 | 12 Oct 2026 | CVSS 4.2 | aaif-goose goosegoose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode… | |
| CVE-2026-109562 | 12 Oct 2026 | CVSS 5.4 | snapotter-hq SnapOtterSnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload… | |
| CVE-2026-109563 | 12 Oct 2026 | CVSS 7.5 | rdfjs N3.jsN3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long… | |
| CVE-2026-109564 | 12 Oct 2026 | CVSS 3.1 | LearnHouseLearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and… | |
| CVE-2026-109379 | 12 Oct 2026 | CVSS 5.3 | cockpit-hq cockpitCockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due to an… | |
| CVE-2026-109380 | 12 Oct 2026 | CVSS 7.5 | ayuhito modern-tarmodern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes… | |
| CVE-2026-109426 | 12 Oct 2026 | CVSS 7.5 | weebzone Telegram-StremioTelegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs… | |
| CVE-2026-109427 | 12 Oct 2026 | CVSS 6.5 | weebzone Telegram-StremioTelegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary… | |
| CVE-2026-109556 | 12 Oct 2026 | CVSS 8.0 | tianma-if EdgeEverEdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender… | |
| CVE-2026-109557 | 12 Oct 2026 | CVSS 8.7 | tianma-if EdgeEverEdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through… | |
| CVE-2026-109558 | 12 Oct 2026 | CVSS 8.7 | tianma-if EdgeEverEdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with… | |
| CVE-2026-109375 | 12 Oct 2026 | CVSS 6.1 | Vercel deepsecVercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files… | |
| CVE-2026-109376 | 12 Oct 2026 | CVSS 4.3 | Frappe ERPNextERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal… | |
| CVE-2026-109377 | 12 Oct 2026 | CVSS 4.3 | Frappe ERPNextERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted… | |
| CVE-2026-109378 | 12 Oct 2026 | CVSS 4.3 | SPIPSPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire/inc/distant.php that follows up to 10 redirects… | |
| CVE-2026-108927 | 12 Oct 2026 | CVSS 6.3 | itsourcecode Baptism Information Management SystemA weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file… | |
| CVE-2026-108928 | 12 Oct 2026 | CVSS 6.3 | itsourcecode Online Admission SystemA security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file… | |
| CVE-2026-108929 | 12 Oct 2026 | CVSS 9.9 | Netcore NR268A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS… | |
| CVE-2026-108930 | 12 Oct 2026 | CVSS 2.7 | Netcore NR268A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file… | |
| CVE-2026-108931 | 12 Oct 2026 | CVSS 4.3 | Netcore NR268A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dhcp_dynamicip_show.cgi of the component DHCP… | |
| CVE-2026-105052 | 12 Oct 2026 | CVSS 7.5 | IBM Maximo Application SuiteIBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could… | |
| CVE-2026-106495 | 12 Oct 2026 | CVSS 4.3 | Backstage: Improper access control in backend action invocationBackstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper… | Fix |
| CVE-2025-71429 | 12 Oct 2026 | CVSS 9.8 | RVC-Boss GPT-SoVITSGPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute… | |
| CVE-2021-48012 | 12 Oct 2026 | CVSS 8.2 | Gin-Quin fast-tomlfast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing… | |
| CVE-2022-51020 | 12 Oct 2026 | CVSS 5.9 | mher flowerFlower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks… | |
| CVE-2024-58389 | 12 Oct 2026 | CVSS 6.1 | HoloViz PanelHoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by… | |
| CVE-2020-37279 | 12 Oct 2026 | CVSS 8.1 | karuppiah7890 easy-pdf-mergeeasy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell… | |
| CVE-2020-37280 | 12 Oct 2026 | CVSS 7.5 | PelionIoT cbor-synccbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking… | |
| CVE-2021-48011 | 12 Oct 2026 | CVSS 7.5 | lukejacksonn servorServor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending… | |
| CVE-2026-95837 | 12 Oct 2026 | CVSS 7.8 | containerd CRI plugin: Checkpoint restore bypasses destination security contextcontainerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable… | Fix |
| CVE-2026-95838 | 12 Oct 2026 | CVSS 4.6 | containerd: Unpack DoS via repeated opaque whiteoutscontainerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses… | Fix |
| CVE-2026-96012 | 12 Oct 2026 | CVSS 9.9 | IBM Db2 Mirror for iIBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses… | |
| CVE-2026-109424 | 12 Oct 2026 | CVSS 5.9 | NetEase Cloud Music for WindowsNetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and… | |
| CVE-2026-109425 | 12 Oct 2026 | CVSS 5.3 | tink-crypto tink-goTink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets()… | |
| CVE-2026-109575 | 12 Oct 2026 | CVSS 9.8 | HAProxy Data Plane API EEIn HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global… | |
| CVE-2026-41510 | 12 Oct 2026 | CVSS 7.2 | Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter floodingOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after… | Fix |
| CVE-2026-108362 | 12 Oct 2026 | CVSS 9.1 | Privasys ra-tls-clientsPrivasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation… | |
| CVE-2026-108923 | 12 Oct 2026 | CVSS 6.3 | 1024-lab smart-adminA vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file… | |
| CVE-2026-108924 | 12 Oct 2026 | CVSS 4.3 | getkirby KirbyA vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file… | |
| CVE-2026-108926 | 12 Oct 2026 | CVSS 6.3 | itsourcecode Baptism Information Management SystemA security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This affects an unknown part of the file ebaptism.php… | |
| CVE-2026-109422 | 12 Oct 2026 | CVSS 8.1 | NetEase Cloud Music for WindowsNetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the… | |
| CVE-2026-109423 | 12 Oct 2026 | CVSS 7.4 | NetEase Cloud Music for WindowsNetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that… | |
| CVE-2026-104332 | 12 Oct 2026 | CVSS 5.5 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a… |
Page 84 of 168