[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108866 | 11 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the… | |
| CVE-2026-108867 | 11 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any… | |
| CVE-2026-108868 | 11 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements… | |
| CVE-2026-108869 | 11 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by… | |
| CVE-2026-108870 | 11 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged… | |
| CVE-2026-108871 | 11 Oct 2026 | CVSS 5.4 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets… | |
| CVE-2026-108872 | 11 Oct 2026 | CVSS 4.3 | JeecgBootJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any… | |
| CVE-2026-108682 | 11 Oct 2026 | CVSS 5.4 | zhayujie CowAgentA weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web… | |
| CVE-2026-108683 | 11 Oct 2026 | CVSS 4.3 | zhayujie CowAgentA security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media… | |
| CVE-2026-108684 | 11 Oct 2026 | CVSS 6.3 | erzhongxmu JeewmsA vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file… | |
| CVE-2026-108861 | 11 Oct 2026 | CVSS 4.3 | erpipe-org Odoo MCPOdoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the… | |
| CVE-2026-108862 | 11 Oct 2026 | CVSS 5.3 | APIParkLab APIParkAPIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications'… | |
| CVE-2026-108863 | 11 Oct 2026 | CVSS 7.5 | Katanemo PlanoKatanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin… | |
| CVE-2026-108864 | 11 Oct 2026 | CVSS 4.2 | iflytek astron-agentiFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other… | |
| CVE-2026-108865 | 11 Oct 2026 | CVSS 8.2 | AmoyLab UnlaAmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens… | |
| CVE-2026-108854 | 11 Oct 2026 | CVSS 5.4 | UnicomAI WanwuWanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users'… | |
| CVE-2026-108855 | 11 Oct 2026 | CVSS 5.4 | UnicomAI WanwuUnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys… | |
| CVE-2026-108856 | 11 Oct 2026 | CVSS 4.2 | UnicomAI WanwuUnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP… | |
| CVE-2026-108857 | 11 Oct 2026 | CVSS 3.3 | Hugging Face Text Embeddings InferenceHugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the… | |
| CVE-2026-108858 | 11 Oct 2026 | CVSS 5.5 | Predibase LoRAXPredibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate… | |
| CVE-2026-108859 | 11 Oct 2026 | CVSS 7.5 | mark3labs mcp-gomcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to… | |
| CVE-2026-108860 | 11 Oct 2026 | CVSS 9.1 | SciSharp BotSharpBotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the… | |
| CVE-2026-108698 | 11 Oct 2026 | CVSS 6.5 | hyper-mcp-rs hyper-mcphyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of… | |
| CVE-2026-108699 | 11 Oct 2026 | CVSS 6.5 | hyper-mcp-rs hyper-mcphyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because… | |
| CVE-2026-108839 | 11 Oct 2026 | CVSS 4.2 | thClawsthClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes… | |
| CVE-2026-108850 | 11 Oct 2026 | CVSS 5.3 | guy-hartstein company-research-agentCompany Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound… | |
| CVE-2026-108851 | 11 Oct 2026 | CVSS 3.3 | thorsten phpMyFAQphpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted… | |
| CVE-2026-108852 | 11 Oct 2026 | CVSS 4.7 | OvidijusParsiunas Deep ChatDeep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because… | |
| CVE-2026-108853 | 11 Oct 2026 | CVSS 8.1 | UnicomAI WanwuUnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other… | |
| CVE-2026-108681 | 11 Oct 2026 | CVSS 4.3 | zhayujie CowAgentA security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the… | |
| CVE-2026-108697 | 11 Oct 2026 | CVSS 4.3 | CoreShopCoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted… | |
| CVE-2026-108758 | 11 Oct 2026 | CVSS 8.2 | alextselegidis easyappointmentsEasy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify… | |
| CVE-2026-108759 | 11 Oct 2026 | CVSS 6.8 | EricLBuehler mistral.rsmistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite… | |
| CVE-2026-108760 | 11 Oct 2026 | CVSS 7.6 | llama-farm llamafarmLlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the… | |
| CVE-2026-108752 | 11 Oct 2026 | CVSS 4.2 | jupyterhubJupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server… | |
| CVE-2026-108753 | 11 Oct 2026 | CVSS 9.4 | agnaistic agnaiAgnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password… | |
| CVE-2026-108754 | 11 Oct 2026 | CVSS 3.3 | tbphp gpt-loadGPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw… | |
| CVE-2026-108755 | 11 Oct 2026 | CVSS 5.3 | hatchet-dev hatchetHatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via… | |
| CVE-2026-108756 | 11 Oct 2026 | CVSS 5.4 | Abilityai trinityAbilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to… | |
| CVE-2026-108757 | 11 Oct 2026 | CVSS 6.5 | Nexting pinclawNexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerability in src/core/http-router.ts that skips the… | |
| CVE-2026-108745 | 11 Oct 2026 | CVSS 3.1 | DBeaver CloudBeaverCloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other… | |
| CVE-2026-108746 | 11 Oct 2026 | CVSS 8.8 | vearchVearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None… | |
| CVE-2026-108747 | 11 Oct 2026 | CVSS 4.2 | lightdashLightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users'… | |
| CVE-2026-108748 | 11 Oct 2026 | CVSS 5.3 | quarkiverse quarkus-langchain4jQuarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that… | |
| CVE-2026-108750 | 11 Oct 2026 | CVSS 4.3 | OpenDocManOpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading… | |
| CVE-2026-108751 | 11 Oct 2026 | CVSS 4.4 | modu-ai moai-adkMoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to… | |
| CVE-2026-108737 | 11 Oct 2026 | CVSS 6.8 | TraccarTraccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session credentials… | |
| CVE-2026-108738 | 11 Oct 2026 | CVSS 4.2 | TraccarTraccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts… | |
| CVE-2026-108739 | 11 Oct 2026 | CVSS 7.5 | openagents-org OpenAgentsOpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list… | |
| CVE-2026-108740 | 11 Oct 2026 | CVSS 8.3 | arp242 GoatCounterGoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to… | |
| CVE-2026-108741 | 11 Oct 2026 | CVSS 3.1 | shepherd-agents ShepherdShepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard… | |
| CVE-2026-108742 | 11 Oct 2026 | CVSS 4.3 | DBeaver CloudBeaverCloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project… | |
| CVE-2026-108744 | 11 Oct 2026 | CVSS 7.0 | MinaSaad1 pbi-clipbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when… | |
| CVE-2026-108730 | 11 Oct 2026 | CVSS 4.3 | The-Commit-Company ravenRaven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace… | |
| CVE-2026-108731 | 11 Oct 2026 | CVSS 5.4 | The-Commit-Company ravenRaven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by… | |
| CVE-2026-108732 | 11 Oct 2026 | CVSS 4.3 | frappe hrmsFrappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the… | |
| CVE-2026-108733 | 11 Oct 2026 | CVSS 4.3 | frappe hrmsFrappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the… | |
| CVE-2026-108734 | 11 Oct 2026 | CVSS 4.3 | frappe crmFrappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated… | |
| CVE-2026-108735 | 11 Oct 2026 | CVSS 4.3 | minifluxMiniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by… | |
| CVE-2026-108736 | 11 Oct 2026 | CVSS 3.7 | alexjustesen speedtest-trackerSpeedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and… | |
| CVE-2026-108724 | 11 Oct 2026 | CVSS 5.3 | SyliusSylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product… | |
| CVE-2026-108725 | 11 Oct 2026 | CVSS 5.4 | cheshire-cat-ai coreCheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to… | |
| CVE-2026-108726 | 11 Oct 2026 | CVSS 4.3 | glpi-project GLPIGLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes… | |
| CVE-2026-108727 | 11 Oct 2026 | CVSS 4.3 | tianma-if EdgeEverEdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens… | |
| CVE-2026-108728 | 11 Oct 2026 | CVSS 6.5 | flyteorg flyteFlyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init… | |
| CVE-2026-108729 | 11 Oct 2026 | CVSS 5.9 | cortezaproject cortezaCorteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to… | |
| CVE-2026-108718 | 11 Oct 2026 | CVSS 8.1 | Rill Data rillRill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically… | |
| CVE-2026-108719 | 11 Oct 2026 | CVSS 5.0 | theopenco LLMGatewayLLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the… | |
| CVE-2026-108720 | 11 Oct 2026 | CVSS 4.3 | phpipamphpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and… | |
| CVE-2026-108721 | 11 Oct 2026 | CVSS 5.3 | iFurySt open-computer-useOpen Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypass the… | |
| CVE-2026-108722 | 11 Oct 2026 | CVSS 4.2 | e2b-dev open-computer-useopen-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/logging.py… | |
| CVE-2026-108723 | 11 Oct 2026 | CVSS 2.5 | QingYunA answer-me-with-htmlanswer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path… | |
| CVE-2026-108712 | 11 Oct 2026 | CVSS 4.3 | SuiteCRMSuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated… | |
| CVE-2026-108713 | 11 Oct 2026 | CVSS 4.3 | SuiteCRMSuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify… | |
| CVE-2026-108714 | 11 Oct 2026 | CVSS 7.5 | modelcontextprotocol kotlin-sdkMCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because… | |
| CVE-2026-108715 | 11 Oct 2026 | CVSS 4.3 | librenmsLibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe… | |
| CVE-2026-108716 | 11 Oct 2026 | CVSS 5.3 | punkpeye mcp-remotemcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives… | |
| CVE-2026-108717 | 11 Oct 2026 | CVSS 6.3 | Combodo iTopCombodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to… | |
| CVE-2026-108576 | 11 Oct 2026 | CVSS 10.0 | TOZED X300A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics… | |
| CVE-2026-108577 | 11 Oct 2026 | CVSS 4.3 | Konstanty Bialkowski libmodplugA vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file… | |
| CVE-2026-108578 | 11 Oct 2026 | CVSS 5.3 | Neterbit NW-431FA vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web… | |
| CVE-2026-108584 | 11 Oct 2026 | CVSS 5.3 | FunnyWolf ViperA security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config… | |
| CVE-2026-108710 | 11 Oct 2026 | CVSS 6.5 | orneryd NornicDBNornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the… | |
| CVE-2026-108711 | 11 Oct 2026 | CVSS 4.3 | Plastic Labs honchoPlastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read… | |
| CVE-2026-108575 | 11 Oct 2026 | CVSS 6.3 | BerriAI LiteLLMA vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_managers/main.py of the… | |
| CVE-2026-108573 | 11 Oct 2026 | CVSS 5.5 | Open Asset Import Library AssimpA vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the function… | |
| CVE-2026-108574 | 11 Oct 2026 | CVSS 4.3 | BerriAI LiteLLMA flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file… | |
| CVE-2026-108571 | 11 Oct 2026 | CVSS 7.3 | Xinhu Rainrock RockOAA weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file… | |
| CVE-2026-108572 | 11 Oct 2026 | CVSS 4.3 | CasdoorA security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file… | |
| CVE-2026-108570 | 11 Oct 2026 | CVSS 6.3 | Furion .NET FrameworkA security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file… | |
| CVE-2026-108569 | 11 Oct 2026 | CVSS 6.3 | Furion .NET FrameworkA vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Replace of the file… | |
| CVE-2026-108567 | 11 Oct 2026 | CVSS 4.3 | InstantSoft icms2A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file system/fields/image.php of the… | |
| CVE-2026-108568 | 11 Oct 2026 | CVSS 4.3 | InstantSoft icms2A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file… | |
| CVE-2026-108566 | 11 Oct 2026 | CVSS 3.5 | InstantSoft icms2A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file… | |
| CVE-2026-108542 | 11 Oct 2026 | CVSS 6.3 | 021is elvix-sdkA vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of the file src/mcp/index.ts of… | |
| CVE-2026-108543 | 11 Oct 2026 | CVSS 6.3 | ag2ai ag2A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the component UserProxyAgent. This… | |
| CVE-2026-108544 | 11 Oct 2026 | CVSS 6.3 | Lippu Docx Reader Office Viewer AppA vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function… | |
| CVE-2026-89305 | 11 Oct 2026 | CVSS 6.5 | Unknown paymendoThe paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any… | |
| CVE-2026-91829 | 11 Oct 2026 | CVSS 7.1 | Unknown Subscribe to CommentsThe Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing… | |
| CVE-2026-93550 | 11 Oct 2026 | CVSS 4.3 | Unknown Veeqo for WooCommerceThe Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL… |
Page 90 of 168