[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108269 | 9 Oct 2026 | CVSS 9.1 | Privasys ra-tls-clientsRemote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS… | |
| CVE-2026-92705 | 9 Oct 2026 | CVSS 7.8 | TypesettingTools AegisubAegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation… | |
| CVE-2026-108266 | 9 Oct 2026 | CVSS 9.1 | Privasys rustlsPrivasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the… | |
| CVE-2026-57458 | 9 Oct 2026 | CVSS 8.1 | Vikunja: Scoped API token can mint unrestricted OAuth session credentialsVikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can… | Fix |
| CVE-2026-62367 | 9 Oct 2026 | CVSS 7.5 | Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverVikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider… | Fix |
| CVE-2026-62376 | 9 Oct 2026 | CVSS 8.1 | Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessVikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and… | Fix |
| CVE-2026-108259 | 9 Oct 2026 | CVSS 8.2 | Tina: Code injection via unescaped Git branch name in generated client sourceTina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or… | Fix |
| CVE-2026-108260 | 9 Oct 2026 | CVSS 7.6 | @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSTina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js… | Fix |
| CVE-2026-108261 | 9 Oct 2026 | CVSS 9.3 | TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentTina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in… | Fix |
| CVE-2026-108263 | 9 Oct 2026 | CVSS 9.9 | iflytek astron-agentAstron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through… | |
| CVE-2026-108264 | 9 Oct 2026 | CVSS 9.1 | wizarrrr wizarrWizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step… | |
| CVE-2026-108265 | 9 Oct 2026 | CVSS 9.1 | Privasys enclave-os-miniEnclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS… | |
| CVE-2026-107852 | 9 Oct 2026 | CVSS 7.1 | JexactylJexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a… | |
| CVE-2026-107854 | 9 Oct 2026 | CVSS 5.4 | JexactylJexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint… | |
| CVE-2026-107856 | 9 Oct 2026 | CVSS 4.5 | civiformCiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0… | |
| CVE-2026-107857 | 9 Oct 2026 | CVSS 4.4 | dongdongbh MindwtrMindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync… | |
| CVE-2026-108258 | 9 Oct 2026 | CVSS 6.9 | Shiny for Python has path traversal in bookmark restoreShiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a… | Fix |
| CVE-2026-107848 | 9 Oct 2026 | CVSS 3.5 | Contao: Cross-site request forgery in custom backend actionsContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while… | Fix |
| CVE-2026-107850 | 9 Oct 2026 | CVSS 4.3 | Contao: Improper access control in the preview links moduleContao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as… | Fix |
| CVE-2026-107851 | 9 Oct 2026 | CVSS 4.3 | Contao: Improper access control in the table access voterContao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in… | Fix |
| CVE-2026-78797 | 9 Oct 2026 | CVSS 9.8 | VulnerabilityAn issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua. | |
| CVE-2026-107842 | 9 Oct 2026 | CVSS 5.3 | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context… | Fix |
| CVE-2026-107843 | 9 Oct 2026 | CVSS 5.3 | Contao: The registration module re-sends activation mailsContao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on… | Fix |
| CVE-2026-107844 | 9 Oct 2026 | CVSS 5.3 | Contao: Path traversal in the images controllerContao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the… | Fix |
| CVE-2026-107845 | 9 Oct 2026 | CVSS 9.3 | Contao: Cross-site scripting in the comments bundleContao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website… | Fix |
| CVE-2026-75351 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityOpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote… | |
| CVE-2026-75352 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityOpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote… | |
| CVE-2026-75353 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityOpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe… | |
| CVE-2026-78835 | 9 Oct 2026 | CVSS 9.8 | VulnerabilityRocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials. | |
| CVE-2026-75350 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityEIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP… | |
| CVE-2026-107841 | 9 Oct 2026 | CVSS 5.7 | pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documentspacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard… | Fix |
| CVE-2026-108096 | 9 Oct 2026 | CVSS 6.5 | aws-amplify/graphql-index-transformerImproper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might… | |
| CVE-2026-107834 | 9 Oct 2026 | CVSS 5.3 | Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processorOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in… | Fix |
| CVE-2026-107835 | 9 Oct 2026 | CVSS 4.0 | corazawaf corazaOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in… | |
| CVE-2026-107836 | 9 Oct 2026 | CVSS 7.1 | RIOT-OS RIOTRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier… | |
| CVE-2026-107837 | 9 Oct 2026 | CVSS 8.2 | RIOT-OS RIOTRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier… | |
| CVE-2026-107838 | 9 Oct 2026 | CVSS 7.5 | RIOT-OS RIOTRIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07… | |
| CVE-2026-107839 | 9 Oct 2026 | CVSS 7.5 | ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of ServiceageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to… | Fix |
| CVE-2026-107840 | 9 Oct 2026 | CVSS 7.5 | yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labelsyopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in… | Fix |
| CVE-2026-107822 | 9 Oct 2026 | CVSS 6.4 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL… | Fix |
| CVE-2026-107823 | 9 Oct 2026 | CVSS 7.2 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB… | Fix |
| CVE-2026-107824 | 9 Oct 2026 | CVSS 9.3 | duty1g x64dbg-mcp-serverx64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1… | |
| CVE-2026-107825 | 9 Oct 2026 | CVSS 4.0 | Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationsOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in… | Fix |
| CVE-2026-107826 | 9 Oct 2026 | CVSS 7.5 | Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in… | Fix |
| CVE-2026-107833 | 9 Oct 2026 | CVSS 5.9 | Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustionOWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in… | Fix |
| CVE-2026-107816 | 9 Oct 2026 | CVSS 6.4 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info… | Fix |
| CVE-2026-107817 | 9 Oct 2026 | CVSS 4.4 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the… | Fix |
| CVE-2026-107818 | 9 Oct 2026 | CVSS 8.4 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the… | Fix |
| CVE-2026-107819 | 9 Oct 2026 | CVSS 5.9 | MariaDB serverMariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB… | |
| CVE-2026-107820 | 9 Oct 2026 | CVSS 5.3 | duty1g x64dbg-mcp-serverx64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2… | |
| CVE-2026-107821 | 9 Oct 2026 | CVSS 8.0 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB… | Fix |
| CVE-2026-75347 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityEIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet… | |
| CVE-2026-75597 | 9 Oct 2026 | CVSS 5.3 | pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typopyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in… | Fix |
| CVE-2026-108159 | 9 Oct 2026 | CVSS 7.5 | iflytek astron-rpaAstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to… | |
| CVE-2026-108160 | 9 Oct 2026 | CVSS 7.5 | iflytek astron-rpaAstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates… | |
| CVE-2026-42695 | 9 Oct 2026 | CVSS 6.5 | FolioVision FV Flowplayer Video PlayerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player… | |
| CVE-2026-48484 | 9 Oct 2026 | CVSS 6.5 | pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process TerminationpyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles… | Fix |
| CVE-2026-55797 | 9 Oct 2026 | CVSS 8.8 | Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLArgo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD… | Fix |
| CVE-2026-108093 | 9 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 10A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is… | |
| CVE-2026-108119 | 9 Oct 2026 | CVSS 6.3 | Red Hat Hardened ImagesA flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not… | |
| CVE-2026-108156 | 9 Oct 2026 | CVSS 7.1 | netease-youdao LobsterAILobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the… | |
| CVE-2026-108157 | 9 Oct 2026 | CVSS 8.1 | smp46 pingvin-share-xPingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over… | |
| CVE-2026-108158 | 9 Oct 2026 | CVSS 6.5 | mynaparrot plugNmeet-serverplugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to… | |
| CVE-2026-107815 | 9 Oct 2026 | CVSS 8.5 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT… | Fix |
| CVE-2025-61560 | 9 Oct 2026 | CVSS 8.1 | VulnerabilityA race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate… | |
| CVE-2016-20098 | 9 Oct 2026 | CVSS 5.4 | toolbox-team reddit-moderator-toolboxModerator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which… | |
| CVE-2026-90983 | 9 Oct 2026 | CVSS 8.2 | Hayat Health Facilities Inc. (Hayat Hospital) Hayat MobileUse of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This… | |
| CVE-2026-75345 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityOpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a… | |
| CVE-2026-75346 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityAn out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList… | |
| CVE-2026-75348 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityAn out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common… | |
| CVE-2026-75349 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityEIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This… | |
| CVE-2026-107813 | 9 Oct 2026 | CVSS 8.8 | Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-upNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation… | Fix |
| CVE-2026-107814 | 9 Oct 2026 | CVSS 8.4 | MariaDB serverMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM… | Fix |
| CVE-2026-108110 | 9 Oct 2026 | CVSS 6.8 | himovo MOVOMOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other… | |
| CVE-2026-108111 | 9 Oct 2026 | CVSS 4.3 | ageerle ruoyi-airuoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private… | |
| CVE-2026-108112 | 9 Oct 2026 | CVSS 5.4 | ageerle ruoyi-airuoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST… | |
| CVE-2026-108113 | 9 Oct 2026 | CVSS 8.8 | ILIAS-eLearning e.V. ILIASILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity)… | |
| CVE-2026-107807 | 9 Oct 2026 | CVSS 8.8 | Nginx UI: Node Secret Credential Exposure via URL Query ParameterNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the… | Fix |
| CVE-2026-107808 | 9 Oct 2026 | CVSS 8.1 | Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn… | Fix |
| CVE-2026-107809 | 9 Oct 2026 | CVSS 8.8 | Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API… | Fix |
| CVE-2026-107810 | 9 Oct 2026 | CVSS 8.1 | Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying… | Fix |
| CVE-2026-107811 | 9 Oct 2026 | CVSS 8.8 | 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and… | Fix |
| CVE-2026-107812 | 9 Oct 2026 | CVSS 7.5 | Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMNginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with… | Fix |
| CVE-2026-107783 | 9 Oct 2026 | CVSS 5.9 | aws-tools-for-powershellInsertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's… | |
| CVE-2026-104084 | 9 Oct 2026 | CVSS 8.8 | Smartertools SmartermailSmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that… | |
| CVE-2026-102554 | 9 Oct 2026 | CVSS 8.2 | Google GuavaAllocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows… | |
| CVE-2026-104082 | 9 Oct 2026 | CVSS 7.2 | Smartertools SmartermailSmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass… | |
| CVE-2026-104083 | 9 Oct 2026 | CVSS 6.1 | Smartertools SmartermailSmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script… | |
| CVE-2026-95702 | 9 Oct 2026 | CVSS 8.5 | Google gVisorUse-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container… | |
| CVE-2026-78795 | 9 Oct 2026 | CVSS 7.5 | VulnerabilityAn issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain… | |
| CVE-2026-78796 | 9 Oct 2026 | CVSS 9.8 | VulnerabilityAn issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute… | |
| CVE-2026-32645 | 9 Oct 2026 | CVSS 6.0 | Red Lion Controls 700 SeriesDefault factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. | |
| CVE-2026-33272 | 9 Oct 2026 | CVSS 4.9 | Red Lion Controls 700 SeriesA malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative… | |
| CVE-2026-33367 | 9 Oct 2026 | CVSS 8.1 | Red Lion Controls 700 SeriesSNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating… | |
| CVE-2026-39453 | 9 Oct 2026 | CVSS 8.3 | Red Lion Controls 700 SeriesNavigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS… | |
| CVE-2026-39460 | 9 Oct 2026 | CVSS 8.1 | Red Lion Controls 700 SeriesUsernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights… | |
| CVE-2026-15340 | 9 Oct 2026 | CVSS 9.8 | Savannah lwIP SMTP clientlwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. | |
| CVE-2026-28745 | 9 Oct 2026 | CVSS 7.5 | Red Lion Controls 700 SeriesUsernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials… | |
| CVE-2026-29797 | 9 Oct 2026 | CVSS 7.1 | Red Lion Controls 700 SeriesNo authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally… | |
| CVE-2026-108109 | 9 Oct 2026 | CVSS 9.1 | hotspotbilling phpnuxbillPHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that… |
Page 96 of 168