[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109339 | 12 Oct 2026 | CVSS 4.9 | surrealdbSurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory… | |
| CVE-2026-109340 | 12 Oct 2026 | CVSS 5.4 | surrealdbSurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by… | |
| CVE-2026-109341 | 12 Oct 2026 | CVSS 7.1 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted… | |
| CVE-2026-109342 | 12 Oct 2026 | CVSS 5.4 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or… | |
| CVE-2026-109343 | 12 Oct 2026 | CVSS 8.1 | surrealdbSurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking… | |
| CVE-2026-109332 | 12 Oct 2026 | CVSS 3.1 | Jovancoding Network-AINetwork-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that… | |
| CVE-2026-109333 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other… | |
| CVE-2026-109334 | 12 Oct 2026 | CVSS 8.1 | surrealdbSurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user… | |
| CVE-2026-109335 | 12 Oct 2026 | CVSS 6.5 | surrealdbSurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level… | |
| CVE-2026-109336 | 12 Oct 2026 | CVSS 4.3 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT… | |
| CVE-2026-109337 | 12 Oct 2026 | CVSS 4.3 | surrealdbSurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT… | |
| CVE-2026-109326 | 12 Oct 2026 | CVSS 7.5 | getgrav gravGrav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only… | |
| CVE-2026-109327 | 12 Oct 2026 | CVSS 6.1 | admidioAdmidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows… | |
| CVE-2026-109328 | 12 Oct 2026 | CVSS 6.1 | admidioAdmidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw… | |
| CVE-2026-109329 | 12 Oct 2026 | CVSS 6.5 | admidioAdmidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users… | |
| CVE-2026-109330 | 12 Oct 2026 | CVSS 4.3 | Jovancoding Network-AINetwork-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live… | |
| CVE-2026-109331 | 12 Oct 2026 | CVSS 7.4 | Jovancoding Network-AINetwork-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny… | |
| CVE-2026-109320 | 12 Oct 2026 | CVSS 5.4 | getgrav grav-plugin-apiThe Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API… | |
| CVE-2026-109321 | 12 Oct 2026 | CVSS 9.1 | getgrav grav-plugin-login-oauthGrav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id>… | |
| CVE-2026-109322 | 12 Oct 2026 | CVSS 6.1 | getgrav grav-plugin-guestbookGrav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert… | |
| CVE-2026-109323 | 12 Oct 2026 | CVSS 5.3 | getgrav grav-plugin-star-ratingsGrav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing… | |
| CVE-2026-109324 | 12 Oct 2026 | CVSS 6.5 | getgrav gravGrav before 2.1.7 contains a denial of service vulnerability that allows authenticated media authors to exhaust memory by uploading compressed… | |
| CVE-2026-109325 | 12 Oct 2026 | CVSS 7.5 | getgrav gravGrav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values… | |
| CVE-2026-109313 | 12 Oct 2026 | CVSS 8.1 | getgrav grav-plugin-loginGrav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor… | |
| CVE-2026-109314 | 12 Oct 2026 | CVSS 7.3 | getgrav grav-plugin-loginGrav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by… | |
| CVE-2026-109315 | 12 Oct 2026 | CVSS 6.5 | getgrav gravGrav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because… | |
| CVE-2026-109316 | 12 Oct 2026 | CVSS 6.5 | getgrav grav-plugin-data-managerGrav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored… | |
| CVE-2026-109317 | 12 Oct 2026 | CVSS 7.2 | getgrav grav-plugin-apiGrav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by… | |
| CVE-2026-109318 | 12 Oct 2026 | CVSS 8.8 | trilbymedia grav-plugin-git-syncGrav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by… | |
| CVE-2026-109319 | 12 Oct 2026 | CVSS 4.3 | getgrav grav-plugin-guestbookGrav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions… | |
| CVE-2026-109307 | 12 Oct 2026 | CVSS 4.7 | craftcms cmsCraft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a… | |
| CVE-2026-109308 | 12 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::actionCacheUpdates to… | |
| CVE-2026-109309 | 12 Oct 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel… | |
| CVE-2026-109310 | 12 Oct 2026 | CVSS 6.5 | siyuan-note siyuanSiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing resource… | |
| CVE-2026-109311 | 12 Oct 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap… | |
| CVE-2026-109312 | 12 Oct 2026 | CVSS 8.1 | getgrav grav-plugin-loginGrav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not… | |
| CVE-2026-109302 | 12 Oct 2026 | CVSS 3.7 | parse-community parse-serverParse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with… | |
| CVE-2026-109303 | 12 Oct 2026 | CVSS 4.3 | parse-community parse-serverParse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user… | |
| CVE-2026-109304 | 12 Oct 2026 | CVSS 4.9 | craftcms cmsCraft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does… | |
| CVE-2026-109305 | 12 Oct 2026 | CVSS 8.8 | craftcms cmsCraft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and… | |
| CVE-2026-109306 | 12 Oct 2026 | CVSS 5.9 | craftcms cmsCraft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any… | |
| CVE-2026-109296 | 12 Oct 2026 | CVSS 4.3 | open-webuiOpen WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by… | |
| CVE-2026-109297 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency… | |
| CVE-2026-109298 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file search tools with a regex engine that expands… | |
| CVE-2026-109299 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability that allows authenticated users with automations permission to stall… | |
| CVE-2026-109300 | 12 Oct 2026 | CVSS 4.6 | open-webuiOpen WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored… | |
| CVE-2026-109301 | 12 Oct 2026 | CVSS 5.9 | parse-community parse-serverParse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code… | |
| CVE-2026-109289 | 12 Oct 2026 | CVSS 6.3 | open-webuiOpen WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal… | |
| CVE-2026-109290 | 12 Oct 2026 | CVSS 7.3 | open-webuiOpen WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to… | |
| CVE-2026-109291 | 12 Oct 2026 | CVSS 7.3 | open-webuiOpen WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims'… | |
| CVE-2026-109292 | 12 Oct 2026 | CVSS 6.8 | open-webuiOpen WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies… | |
| CVE-2026-109293 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export… | |
| CVE-2026-109294 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server… | |
| CVE-2026-109295 | 12 Oct 2026 | CVSS 6.5 | open-webuiOpen WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server… | |
| CVE-2026-109282 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method… | |
| CVE-2026-109283 | 12 Oct 2026 | CVSS 5.4 | open-webuiOpen WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only from the… | |
| CVE-2026-109284 | 12 Oct 2026 | CVSS 4.3 | open-webuiOpen WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the… | |
| CVE-2026-109285 | 12 Oct 2026 | CVSS 5.0 | open-webuiOpen WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base… | |
| CVE-2026-109286 | 12 Oct 2026 | CVSS 8.1 | open-webuiOpen WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a… | |
| CVE-2026-109287 | 12 Oct 2026 | CVSS 4.3 | open-webuiOpen WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id… | |
| CVE-2026-109288 | 12 Oct 2026 | CVSS 6.4 | open-webuiOpen WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into… | |
| CVE-2026-109276 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when… | |
| CVE-2026-109277 | 12 Oct 2026 | CVSS 3.3 | ImageMagickImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling… | |
| CVE-2026-109278 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the wavelet-denoise operation, which fails to release allocated memory… | |
| CVE-2026-109279 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 lacks proper synchronization when the security policy is accessed, so simultaneous reads and… | |
| CVE-2026-109280 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a… | |
| CVE-2026-109281 | 12 Oct 2026 | CVSS 4.4 | ImageMagickImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond… | |
| CVE-2026-109269 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the JPEG decoder, which performs a read that… | |
| CVE-2026-109270 | 12 Oct 2026 | CVSS 3.3 | ImageMagickImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations… | |
| CVE-2026-109271 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during… | |
| CVE-2026-109272 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached… | |
| CVE-2026-109273 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an information disclosure vulnerability in the PostScript decoder, which allocates a… | |
| CVE-2026-109274 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy… | |
| CVE-2026-109275 | 12 Oct 2026 | CVSS 4.8 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used… | |
| CVE-2026-109262 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory… | |
| CVE-2026-109263 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV encoder, which fails to release allocated memory when a… | |
| CVE-2026-109264 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An… | |
| CVE-2026-109265 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to… | |
| CVE-2026-109266 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape… | |
| CVE-2026-109267 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to… | |
| CVE-2026-109268 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000… | |
| CVE-2026-109256 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc… | |
| CVE-2026-109257 | 12 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial… | |
| CVE-2026-109258 | 12 Oct 2026 | CVSS 2.5 | ImageMagickImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerability in the fx operation that occurs when initialization of an FX… | |
| CVE-2026-109259 | 12 Oct 2026 | CVSS 5.3 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents… | |
| CVE-2026-109260 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng… | |
| CVE-2026-109261 | 12 Oct 2026 | CVSS 3.7 | ImageMagickImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color… | |
| CVE-2026-109249 | 12 Oct 2026 | CVSS 5.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assistance_parse_all_elements_of() because it advances its parsing cursor… | |
| CVE-2026-109250 | 12 Oct 2026 | CVSS 6.6 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed… | |
| CVE-2026-109251 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit… | |
| CVE-2026-109252 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash… | |
| CVE-2026-109253 | 12 Oct 2026 | CVSS 5.3 | FreeRDPFreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in the RDPEAR NDR scalar readers, which check value length before… | |
| CVE-2026-109254 | 12 Oct 2026 | CVSS 5.9 | FreeRDPFreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and… | |
| CVE-2026-109255 | 12 Oct 2026 | CVSS 6.8 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger… | |
| CVE-2026-109242 | 12 Oct 2026 | CVSS 7.1 | FreeRDPFreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is… | |
| CVE-2026-109243 | 12 Oct 2026 | CVSS 4.4 | FreeRDPFreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vulnerability that allows local users to read private keys written by… | |
| CVE-2026-109244 | 12 Oct 2026 | CVSS 6.6 | FreeRDPFreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability in winpr-makecert that creates unencrypted private keys without… | |
| CVE-2026-109245 | 12 Oct 2026 | CVSS 6.8 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that… | |
| CVE-2026-109246 | 12 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge… | |
| CVE-2026-109247 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c… |
Page 86 of 168