[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-109248 | 12 Oct 2026 | CVSS 6.5 | FreeRDPFreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convert_filedescriptors_to_file_list(), which scans a… | |
| CVE-2026-109237 | 12 Oct 2026 | CVSS 8.1 | unclecode crawl4aiCrawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by… | |
| CVE-2026-109238 | 12 Oct 2026 | CVSS 8.6 | unclecode crawl4aiCrawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach internal addresses by enabling… | |
| CVE-2026-109239 | 12 Oct 2026 | CVSS 5.3 | unclecode crawl4aiCrawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability in RobotsParser.can_fetch that lets unauthenticated attackers bypass… | |
| CVE-2026-109240 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by… | |
| CVE-2026-109241 | 12 Oct 2026 | CVSS 3.1 | FreeRDPFreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to… | |
| CVE-2026-108477 | 12 Oct 2026 | CVSS 5.3 | Arraytics BookticsMissing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-108478 | 12 Oct 2026 | CVSS 6.5 | BdThemes Element Pack Elementor AddonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons… | |
| CVE-2026-108907 | 12 Oct 2026 | CVSS 10.0 | Netcore NR268A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes… | |
| CVE-2026-108908 | 12 Oct 2026 | CVSS 2.4 | Netcore NR268A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file… | |
| CVE-2026-108909 | 12 Oct 2026 | CVSS 4.3 | Netcore NR268A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint… | |
| CVE-2026-108914 | 12 Oct 2026 | CVSS 9.9 | Edimax BR-6208ACA flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown functionality of the file /goform/formWlSiteSurvey. This… | |
| CVE-2026-105274 | 12 Oct 2026 | CVSS 2.1 | erlang rebar3Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server… | |
| CVE-2026-108475 | 12 Oct 2026 | CVSS 4.3 | VideoWhisper.com Broadcast Live VideoMissing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly… | |
| CVE-2026-108476 | 12 Oct 2026 | CVSS 5.0 | VideoWhisper.com Paid Videochat Turnkey SiteMissing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-9191 | 12 Oct 2026 | CVSS 9.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through… | |
| CVE-2026-85955 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke… | |
| CVE-2026-85956 | 12 Oct 2026 | CVSS 9.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator… | |
| CVE-2026-92681 | 12 Oct 2026 | CVSS 9.3 | Neo4j @neo4j/graphqlIn @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation types are… | |
| CVE-2026-92682 | 12 Oct 2026 | CVSS 8.6 | Neo4j @neo4j/graphqlIn @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections… | |
| CVE-2026-96612 | 12 Oct 2026 | CVSS 7.5 | hexpm hexImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to… | |
| CVE-2026-96618 | 12 Oct 2026 | CVSS 2.1 | hexpm hexImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory… | |
| CVE-2026-85947 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management… | |
| CVE-2026-85948 | 12 Oct 2026 | CVSS 9.9 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API… | |
| CVE-2026-85949 | 12 Oct 2026 | CVSS 8.1 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs… | |
| CVE-2026-85950 | 12 Oct 2026 | CVSS 8.4 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote… | |
| CVE-2026-85951 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnerability… | |
| CVE-2026-85952 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerAffected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request forgery… | |
| CVE-2026-85953 | 12 Oct 2026 | CVSS 8.5 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not… | |
| CVE-2026-85954 | 12 Oct 2026 | CVSS 8.6 | Progress Software Corporation MarkLogic ServerProgress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled values supplied to certain… | |
| CVE-2026-109396 | 12 Oct 2026 | CVSS 4.2 | TheliaThelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet… | |
| CVE-2026-109397 | 12 Oct 2026 | CVSS 7.2 | TheliaThelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload… | |
| CVE-2026-109398 | 12 Oct 2026 | CVSS 7.5 | gumlet php-image-resizeGumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes… | |
| CVE-2026-109399 | 12 Oct 2026 | CVSS 8.1 | sbabic swupdateSWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted… | |
| CVE-2026-81856 | 12 Oct 2026 | CVSS 2.3 | hexpm hexImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository… | |
| CVE-2026-109194 | 12 Oct 2026 | CVSS 6.4 | Red Hat Quay 3A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger… | |
| CVE-2026-109195 | 12 Oct 2026 | CVSS 3.1 | Red Hat Quay 3A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized… | |
| CVE-2026-109391 | 12 Oct 2026 | CVSS 8.1 | Square SquashSquare Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML… | |
| CVE-2026-109392 | 12 Oct 2026 | CVSS 5.4 | PimcorePimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing… | |
| CVE-2026-109393 | 12 Oct 2026 | CVSS 6.3 | Webkul QloAppsQloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController… | |
| CVE-2026-109394 | 12 Oct 2026 | CVSS 7.4 | thirty beesThirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated… | |
| CVE-2026-107248 | 12 Oct 2026 | CVSS 8.8 | TheliaThelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the… | |
| CVE-2026-108899 | 12 Oct 2026 | CVSS 7.3 | tobychui zoraxyA flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the… | |
| CVE-2026-108900 | 12 Oct 2026 | CVSS 7.3 | Exponent CMSA vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC… | |
| CVE-2026-108901 | 12 Oct 2026 | CVSS 3.5 | Shenzhen HCC Technology MPOS M6 PLUSA vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component… | |
| CVE-2026-108906 | 12 Oct 2026 | CVSS 7.2 | Netcore NR268A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file… | |
| CVE-2026-103503 | 12 Oct 2026 | CVSS 5.9 | hexpm hexImproper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex… | |
| CVE-2026-105280 | 12 Oct 2026 | CVSS 6.9 | hexpm hexImproper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch… | |
| CVE-2026-105668 | 12 Oct 2026 | CVSS 7.1 | hexpm hexProtection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get… | |
| CVE-2026-103060 | 12 Oct 2026 | CVSS 7.5 | erlang rebar3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to… | |
| CVE-2026-92877 | 12 Oct 2026 | CVSS 8.3 | Eclipse Foundation jaxb-ri (core)The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP… | |
| CVE-2026-108094 | 12 Oct 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious… | |
| CVE-2026-108895 | 12 Oct 2026 | CVSS 9.9 | Linksys E1700A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a… | |
| CVE-2026-108896 | 12 Oct 2026 | CVSS 9.9 | Linksys E1700A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation… | |
| CVE-2026-108897 | 12 Oct 2026 | CVSS 5.3 | Smart Media4U Technology SHAREit AppA security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function… | |
| CVE-2026-108898 | 12 Oct 2026 | CVSS 3.5 | Netis WF2409EA vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulation of the… | |
| CVE-2026-109390 | 12 Oct 2026 | CVSS 9.8 | AnyDeskAnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for… | |
| CVE-2026-103526 | 12 Oct 2026 | CVSS 3.7 | TheliaIn Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect… | |
| CVE-2026-103527 | 12 Oct 2026 | CVSS 6.1 | TheliaThelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling… | |
| CVE-2026-103528 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can… | |
| CVE-2026-103529 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing… | |
| CVE-2026-103535 | 12 Oct 2026 | CVSS 8.8 | TheliaThelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code… | |
| CVE-2026-103537 | 12 Oct 2026 | CVSS 5.4 | TheliaThelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The… | |
| CVE-2026-103521 | 12 Oct 2026 | CVSS 7.2 | TheliaIn Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform… | |
| CVE-2026-103522 | 12 Oct 2026 | CVSS 7.2 | TheliaIn Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An… | |
| CVE-2026-103523 | 12 Oct 2026 | CVSS 6.1 | TheliaThelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits… | |
| CVE-2026-103524 | 12 Oct 2026 | CVSS 4.8 | TheliaThelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without… | |
| CVE-2026-109228 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by… | |
| CVE-2026-109229 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection process-wide by setting… | |
| CVE-2026-12613 | 12 Oct 2026 | CVSS 8.8 | Ministry of Justice General Directorate of Information Technology UYAP Document EditorDeserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows… | |
| CVE-2026-18390 | 12 Oct 2026 | CVSS 7.8 | Ministry of Justice General Directorate of Information Technology UYAP Document EditorImproper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate… | |
| CVE-2026-109204 | 12 Oct 2026 | CVSS 6.3 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password… | |
| CVE-2026-109205 | 12 Oct 2026 | CVSS 7.5 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to… | |
| CVE-2026-109206 | 12 Oct 2026 | CVSS 5.3 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid… | |
| CVE-2026-109225 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by… | |
| CVE-2026-109226 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting… | |
| CVE-2026-109227 | 12 Oct 2026 | CVSS 7.5 | sgl-project sglangSGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source… | |
| CVE-2026-109169 | 12 Oct 2026 | CVSS 6.5 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the… | |
| CVE-2026-109170 | 12 Oct 2026 | CVSS 6.5 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to… | |
| CVE-2026-109199 | 12 Oct 2026 | CVSS 8.8 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting… | |
| CVE-2026-109200 | 12 Oct 2026 | CVSS 6.4 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches… | |
| CVE-2026-109201 | 12 Oct 2026 | CVSS 8.3 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated… | |
| CVE-2026-109202 | 12 Oct 2026 | CVSS 6.5 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to… | |
| CVE-2026-109203 | 12 Oct 2026 | CVSS 6.5 | LogicalDOC Community EditionLogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to… | |
| CVE-2026-108890 | 12 Oct 2026 | CVSS 6.3 | BlackBeltTechnology pi-agent-dashboardA vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the function terminalManager.spawn of… | |
| CVE-2026-108892 | 12 Oct 2026 | CVSS 10.0 | Linksys E1700A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of the file… | |
| CVE-2026-108893 | 12 Oct 2026 | CVSS 9.9 | Linksys E1700A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such… | |
| CVE-2026-108894 | 12 Oct 2026 | CVSS 9.9 | Linksys E1700A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the… | |
| CVE-2026-103502 | 12 Oct 2026 | CVSS 5.9 | hexpm hex_coreImproper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm… | |
| CVE-2026-93693 | 12 Oct 2026 | CVSS 6.5 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP… | |
| CVE-2026-93694 | 12 Oct 2026 | CVSS 4.0 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to an unvalidated callback URL… | |
| CVE-2026-93695 | 12 Oct 2026 | CVSS 7.4 | Progress ShareFile Storage Zones ControllerIn Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary… | |
| CVE-2026-109186 | 12 Oct 2026 | CVSS 8.8 | jishenghua jshERPjshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite… | |
| CVE-2026-109187 | 12 Oct 2026 | CVSS 6.5 | jishenghua jshERPjshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets… | |
| CVE-2026-109188 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via… | |
| CVE-2026-52903 | 12 Oct 2026 | CVSS 8.8 | ManageIQA deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to… | |
| CVE-2026-109181 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list… | |
| CVE-2026-109182 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data… | |
| CVE-2026-109183 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in… | |
| CVE-2026-109184 | 12 Oct 2026 | CVSS 4.3 | jishenghua jshERPjshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account… |
Page 87 of 168