[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104364 | 12 Oct 2026 | CVSS 3.3 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation. | |
| CVE-2026-104774 | 12 Oct 2026 | CVSS 5.8 | Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF BypassOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in… | Fix |
| CVE-2026-108361 | 12 Oct 2026 | CVSS 7.2 | Privasys ra-tls-clientsPrivasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with… | |
| CVE-2025-27896 | 12 Oct 2026 | CVSS 6.1 | IBM DB2 Recovery Expert for Linux, UNIX and WindowsIBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… | |
| CVE-2025-27897 | 12 Oct 2026 | CVSS 6.1 | IBM DB2 Recovery Expert for Linux, UNIX and WindowsIBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… | |
| CVE-2025-27902 | 12 Oct 2026 | CVSS 6.1 | IBM DB2 Recovery Expert for Linux, UNIX and WindowsIBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could… | |
| CVE-2025-27895 | 12 Oct 2026 | CVSS 6.1 | IBM DB2 Recovery Expert for Linux, UNIX and WindowsIBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… | |
| CVE-2026-85471 | 12 Oct 2026 | CVSS 6.4 | Red Hat mirror registry for Red Hat OpenShiftA flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a… | |
| CVE-2026-87744 | 12 Oct 2026 | CVSS 9.1 | Red Hat build of Quarkus 3.27.6.redhatA flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated… | |
| CVE-2026-89140 | 12 Oct 2026 | CVSS 6.0 | Temporal Technologies, Inc. Temporal ServerTemporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write… | |
| CVE-2026-57143 | 12 Oct 2026 | CVSS 8.8 | MervinPraison praisonaiagentsPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled… | |
| CVE-2026-59976 | 12 Oct 2026 | CVSS 8.1 | C4illin ConvertXConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct… | |
| CVE-2026-59977 | 12 Oct 2026 | CVSS 8.1 | C4illin ConvertXConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses HTTP GET for permanent deletion without CSRF… | |
| CVE-2026-65954 | 12 Oct 2026 | CVSS 8.6 | PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2.3… | Fix |
| CVE-2026-78404 | 12 Oct 2026 | CVSS 6.5 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalation via the db2pd utility. | |
| CVE-2026-83535 | 12 Oct 2026 | CVSS 7.4 | Red Hat OpenStack Platform 18.0A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security… | |
| CVE-2026-83536 | 12 Oct 2026 | CVSS 5.3 | Red Hat OpenStack Platform 18.0A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as… | |
| CVE-2026-108919 | 12 Oct 2026 | CVSS 4.3 | SourceCodester Drug Recommendation SystemA weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file… | |
| CVE-2026-108920 | 12 Oct 2026 | CVSS 4.3 | SourceCodester Drug Recommendation SystemA security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file… | |
| CVE-2026-108921 | 12 Oct 2026 | CVSS 7.3 | KusalkaSilva Learning-Management-SystemA vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function… | |
| CVE-2026-108922 | 12 Oct 2026 | CVSS 6.3 | KusalkaSilva Learning-Management-SystemA flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function… | |
| CVE-2026-18166 | 12 Oct 2026 | CVSS 7.7 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a remote authenticated… | |
| CVE-2026-57118 | 12 Oct 2026 | CVSS 9.8 | MervinPraison PraisonAIPraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST… | |
| CVE-2026-105464 | 12 Oct 2026 | CVSS 8.8 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to… | |
| CVE-2026-105465 | 12 Oct 2026 | CVSS 8.8 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance. | |
| CVE-2026-105466 | 12 Oct 2026 | CVSS 6.5 | IBM Db2IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under… | |
| CVE-2026-107226 | 12 Oct 2026 | CVSS 6.8 | AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSThe AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0… | Fix |
| CVE-2026-102663 | 12 Oct 2026 | CVSS 4.3 | OpenListTeam OpenListOpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware… | |
| CVE-2026-103061 | 12 Oct 2026 | CVSS 5.9 | GleamImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher… | |
| CVE-2026-104102 | 12 Oct 2026 | CVSS 5.3 | copyparty FTP: upload outside defined volumes (limited path traversal)copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When… | Fix |
| CVE-2026-104355 | 12 Oct 2026 | CVSS 7.0 | Temporal Technologies, Inc. Temporal ServerA connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving… | |
| CVE-2026-42689 | 12 Oct 2026 | CVSS 3.7 | Pixelite Events ManagerConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Pixelite Events Manager events-manager… | |
| CVE-2026-61994 | 12 Oct 2026 | CVSS 5.4 | RocketGeek WP-MembersMissing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-6232 | 12 Oct 2026 | CVSS 5.2 | Semtech LR1110 TransceiverAn out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware where a crafted SPI host command with… | |
| CVE-2026-77363 | 12 Oct 2026 | CVSS 8.8 | The-40-Thieves obsidian-tcobsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not… | |
| CVE-2026-77364 | 12 Oct 2026 | CVSS 6.5 | The-40-Thieves obsidian-tcobsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings… | |
| CVE-2026-77366 | 12 Oct 2026 | CVSS 9.9 | The-40-Thieves obsidian-tcobsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the… | |
| CVE-2026-108917 | 12 Oct 2026 | CVSS 10.0 | Edimax BR-6208ACA vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing… | |
| CVE-2026-108918 | 12 Oct 2026 | CVSS 10.0 | Edimax BR-6208ACA vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the… | |
| CVE-2026-109448 | 12 Oct 2026 | CVSS 5.9 | PostgreSQL psqlODBCInteger wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one… | Fix |
| CVE-2026-108479 | 12 Oct 2026 | CVSS 8.1 | Patreon WordPressCross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects… | |
| CVE-2026-108481 | 12 Oct 2026 | CVSS 7.4 | Patreon WordPressCross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects… | |
| CVE-2026-108482 | 12 Oct 2026 | CVSS 6.5 | LeapWorx Premium Addons for ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor… | |
| CVE-2026-108486 | 12 Oct 2026 | CVSS 5.3 | WPMU DEV ForminatorMissing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-108915 | 12 Oct 2026 | CVSS 9.9 | Edimax BR-6208ACA vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the… | |
| CVE-2026-108916 | 12 Oct 2026 | CVSS 8.3 | Edimax BR-6208ACA vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation… | |
| CVE-2026-103080 | 12 Oct 2026 | CVSS 5.3 | VillaTheme SalevoExternal Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue… | |
| CVE-2026-107418 | 12 Oct 2026 | CVSS 5.4 | Arraytics BookticsMissing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-107862 | 12 Oct 2026 | CVSS 6.5 | ExpressTech Quiz And Survey MasterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master… | |
| CVE-2026-85973 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned… | |
| CVE-2026-85974 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently validate TLS certificate hostnames for… | |
| CVE-2026-85975 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by… | |
| CVE-2026-85976 | 12 Oct 2026 | CVSS 5.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query Console… | |
| CVE-2026-94451 | 12 Oct 2026 | CVSS 6.5 | Red Hat build of Quarkus 3.27.6.redhatQuarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not… | |
| CVE-2026-85965 | 12 Oct 2026 | CVSS 8.0 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory-safety defects in the JavaScript engine… | |
| CVE-2026-85966 | 12 Oct 2026 | CVSS 7.7 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain… | |
| CVE-2026-85967 | 12 Oct 2026 | CVSS 6.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a… | |
| CVE-2026-85968 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote… | |
| CVE-2026-85969 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain… | |
| CVE-2026-85970 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple… | |
| CVE-2026-85971 | 12 Oct 2026 | CVSS 7.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to… | |
| CVE-2026-85972 | 12 Oct 2026 | CVSS 7.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently verify the identity of a Kerberos… | |
| CVE-2026-85958 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow… | |
| CVE-2026-85959 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in… | |
| CVE-2026-85960 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console. A remote attacker… | |
| CVE-2026-85961 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerOn Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive… | |
| CVE-2026-85962 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML… | |
| CVE-2026-85963 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses… | |
| CVE-2026-85964 | 12 Oct 2026 | CVSS 7.7 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path… | |
| CVE-2026-109373 | 12 Oct 2026 | CVSS 8.1 | zitadelZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other… | |
| CVE-2026-109374 | 12 Oct 2026 | CVSS 5.5 | zitadelZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate… | |
| CVE-2026-75888 | 12 Oct 2026 | CVSS 7.7 | Red Hat OpenShift Container Platform 4.19A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing… | |
| CVE-2026-84286 | 12 Oct 2026 | CVSS 9.8 | Turboderp-org ExLlamaV3ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bounds. A… | |
| CVE-2026-85957 | 12 Oct 2026 | CVSS 7.5 | Progress Software Corporation MarkLogic ServerAffected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which… | |
| CVE-2026-109364 | 12 Oct 2026 | CVSS 5.3 | ZcashFoundation zebraZebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores… | |
| CVE-2026-109365 | 12 Oct 2026 | CVSS 3.7 | ZcashFoundation zebraZebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by… | |
| CVE-2026-109366 | 12 Oct 2026 | CVSS 3.7 | ZcashFoundation zebraZebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to… | |
| CVE-2026-109371 | 12 Oct 2026 | CVSS 8.2 | zitadelZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the… | |
| CVE-2026-109372 | 12 Oct 2026 | CVSS 8.7 | zitadelZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the… | |
| CVE-2026-109357 | 12 Oct 2026 | CVSS 8.1 | librenmsLibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped… | |
| CVE-2026-109358 | 12 Oct 2026 | CVSS 7.8 | edgelesssys contrastEdgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config… | |
| CVE-2026-109359 | 12 Oct 2026 | CVSS 7.7 | edgelesssys contrastContrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses… | |
| CVE-2026-109360 | 12 Oct 2026 | CVSS 7.5 | Project-MONAI MONAIMONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet… | |
| CVE-2026-109361 | 12 Oct 2026 | CVSS 7.3 | Project-MONAI MONAIMONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from… | |
| CVE-2026-109362 | 12 Oct 2026 | CVSS 5.4 | heymrun heymHeym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by… | |
| CVE-2026-109363 | 12 Oct 2026 | CVSS 7.5 | ZcashFoundation zebraZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during… | |
| CVE-2026-109351 | 12 Oct 2026 | CVSS 6.5 | GitoxideLabs gix-packGitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by… | |
| CVE-2026-109352 | 12 Oct 2026 | CVSS 6.1 | librenmsLibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless… | |
| CVE-2026-109353 | 12 Oct 2026 | CVSS 7.1 | librenmsLibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued… | |
| CVE-2026-109354 | 12 Oct 2026 | CVSS 4.3 | librenmsLibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized… | |
| CVE-2026-109355 | 12 Oct 2026 | CVSS 6.1 | librenmsLibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP… | |
| CVE-2026-109356 | 12 Oct 2026 | CVSS 4.3 | librenmsLibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete… | |
| CVE-2026-109344 | 12 Oct 2026 | CVSS 6.1 | cure53 DOMPurifyDOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by… | |
| CVE-2026-109345 | 12 Oct 2026 | CVSS 6.1 | cure53 DOMPurifyDOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a… | |
| CVE-2026-109346 | 12 Oct 2026 | CVSS 8.1 | better-authbetter-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device… | |
| CVE-2026-109347 | 12 Oct 2026 | CVSS 7.2 | vrana adminerAdminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO… | |
| CVE-2026-109348 | 12 Oct 2026 | CVSS 4.3 | GitoxideLabs gix-mailmapGitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in… | |
| CVE-2026-109349 | 12 Oct 2026 | CVSS 6.5 | GitoxideLabs gix-packgitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but… | |
| CVE-2026-109350 | 12 Oct 2026 | CVSS 6.5 | GitoxideLabs gix-packGitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted… | |
| CVE-2026-109338 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header… |
Page 85 of 168