[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107911 | 9 Oct 2026 | CVSS 7.5 | FalkorDBA type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated… | |
| CVE-2026-107914 | 9 Oct 2026 | CVSS 7.8 | backdropcms BackdropBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This… | |
| CVE-2026-87108 | 9 Oct 2026 | CVSS 4.3 | MongoDB Ops ManagerAn authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when… | |
| CVE-2026-107908 | 9 Oct 2026 | CVSS 9.8 | FalkorDBA heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated… | |
| CVE-2026-7826 | 9 Oct 2026 | CVSS 9.1 | FalkorDBA heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a… | |
| CVE-2026-7827 | 9 Oct 2026 | CVSS 8.1 | FalkorDBA stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in… | |
| CVE-2026-107888 | 9 Oct 2026 | CVSS 5.5 | OpenPrinting CUPSOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary… | Fix |
| CVE-2026-107889 | 9 Oct 2026 | CVSS 5.5 | Red Hat Build of KeycloakA flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input… | |
| CVE-2026-107890 | 9 Oct 2026 | CVSS 5.5 | OpenPrinting CUPSOpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates… | Fix |
| CVE-2026-5759 | 9 Oct 2026 | CVSS 9.8 | FalkorDBA double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders… | |
| CVE-2026-107886 | 9 Oct 2026 | CVSS 6.5 | OpenPrinting CUPSOpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member… | Fix |
| CVE-2026-107885 | 9 Oct 2026 | CVSS 5.5 | OpenPrinting CUPSOpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler… | |
| CVE-2026-97031 | 8 Oct 2026 | CVSS 7.5 | Go standard library crypto/tlsMultiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger… | |
| CVE-2026-97032 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the… | |
| CVE-2026-94444 | 8 Oct 2026 | CVSS 7.8 | Go toolchain cmd/goPreviously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user… | |
| CVE-2026-94447 | 8 Oct 2026 | CVSS 7.8 | Go toolchain cmd/goPreviously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious… | |
| CVE-2026-94448 | 8 Oct 2026 | CVSS 6.1 | Go standard library html/templateWhen a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new… | |
| CVE-2026-94510 | 8 Oct 2026 | CVSS 9.9 | Microsoft BookingsAuthorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-96207 | 8 Oct 2026 | CVSS 10.0 | Microsoft Partner CenterImproper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. | |
| CVE-2026-97030 | 8 Oct 2026 | CVSS 6.1 | Go standard library html/templateA trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now… | |
| CVE-2026-78669 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpA malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small… | |
| CVE-2026-83943 | 8 Oct 2026 | CVSS 8.7 | Microsoft Azure API CenterExposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network. | |
| CVE-2026-83947 | 8 Oct 2026 | CVSS 6.5 | Microsoft Azure Event Grid SystemMissing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. | |
| CVE-2026-88131 | 8 Oct 2026 | CVSS 9.8 | Microsoft DataverseDeserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-94439 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly… | |
| CVE-2026-94440 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/textprotoParsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is… | |
| CVE-2026-77900 | 8 Oct 2026 | CVSS 9.8 | Microsoft Azure App Service for LinuxMissing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-78659 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the… | |
| CVE-2026-78660 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHistorically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2… | |
| CVE-2026-78663 | 8 Oct 2026 | CVSS 9.1 | Go standard library net/httpThe HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any… | |
| CVE-2026-78667 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive… | |
| CVE-2026-69435 | 8 Oct 2026 | CVSS 8.1 | Microsoft Azure SRE AgentMissing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-56857 | 8 Oct 2026 | CVSS 9.8 | Go standard library osOn Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the… | |
| CVE-2026-56866 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing… | |
| CVE-2026-107802 | 8 Oct 2026 | CVSS 7.1 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in… | |
| CVE-2026-107733 | 8 Oct 2026 | CVSS 6.8 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to… | |
| CVE-2026-107734 | 8 Oct 2026 | CVSS 7.1 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f… | |
| CVE-2026-107735 | 8 Oct 2026 | CVSS 5.4 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with… | |
| CVE-2026-107736 | 8 Oct 2026 | CVSS 6.8 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled… | |
| CVE-2026-107737 | 8 Oct 2026 | CVSS 5.7 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize… | |
| CVE-2026-107738 | 8 Oct 2026 | CVSS 6.8 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from… | |
| CVE-2026-107727 | 8 Oct 2026 | CVSS 3.7 | Strawberry legacy graphql-ws retains naturally completed subscription slotsStrawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in… | Fix |
| CVE-2026-107728 | 8 Oct 2026 | CVSS 7.5 | Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyStrawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field resolver… | Fix |
| CVE-2026-107729 | 8 Oct 2026 | CVSS 5.5 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed… | |
| CVE-2026-107730 | 8 Oct 2026 | CVSS 5.5 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces… | |
| CVE-2026-107731 | 8 Oct 2026 | CVSS 5.5 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow… | |
| CVE-2026-107732 | 8 Oct 2026 | CVSS 8.4 | sumatrapdfreader sumatrapdfSumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into… | |
| CVE-2026-105672 | 8 Oct 2026 | CVSS 8.7 | TP-Link Systems Inc. Tapo C325WB v2TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker… | |
| CVE-2026-105673 | 8 Oct 2026 | CVSS 7.1 | TP-Link Systems Inc. Tapo C325WB v2An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account… | |
| CVE-2026-105674 | 8 Oct 2026 | CVSS 8.7 | TP-Link Systems Inc. Tapo C325WB v2TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator… | |
| CVE-2026-107651 | 8 Oct 2026 | CVSS 5.5 | Red Hat Enterprise Linux 6A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing… | |
| CVE-2026-87980 | 8 Oct 2026 | CVSS 5.5 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive… | Fix |
| CVE-2026-89091 | 8 Oct 2026 | CVSS 8.8 | Red Hat Migration Toolkit for Applications 8A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths… | |
| CVE-2026-84249 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication… | |
| CVE-2026-84875 | 8 Oct 2026 | CVSS 8.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Fix |
| CVE-2026-84891 | 8 Oct 2026 | CVSS 7.5 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials. | |
| CVE-2026-84035 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. | Fix |
| CVE-2026-84057 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special… | |
| CVE-2026-84058 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A… | Fix |
| CVE-2026-84198 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Fix |
| CVE-2026-84209 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of… | |
| CVE-2026-84230 | 8 Oct 2026 | CVSS 5.9 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent… | Fix |
| CVE-2026-84246 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Fix |
| CVE-2026-84247 | 8 Oct 2026 | CVSS 6.5 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. | Fix |
| CVE-2026-75875 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal. | |
| CVE-2026-80381 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection. | Fix |
| CVE-2026-81932 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL… | Fix |
| CVE-2026-82895 | 8 Oct 2026 | CVSS 9.8 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow. | Fix |
| CVE-2026-82900 | 8 Oct 2026 | CVSS 9.1 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a… | |
| CVE-2026-84032 | 8 Oct 2026 | CVSS 8.1 | IBM Guardium Data ProtectionIBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation. | Fix |
| CVE-2026-107799 | 8 Oct 2026 | CVSS 5.4 | banq jivejdonJivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized… | |
| CVE-2026-107800 | 8 Oct 2026 | CVSS 5.4 | banq jivejdonJivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short… | |
| CVE-2026-107801 | 8 Oct 2026 | CVSS 5.4 | banq jivejdonJivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading… | |
| CVE-2026-107828 | 8 Oct 2026 | CVSS 6.5 | banq jivejdonJivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by… | |
| CVE-2026-107829 | 8 Oct 2026 | CVSS 5.9 | banq jivejdonJivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in… | |
| CVE-2026-107830 | 8 Oct 2026 | CVSS 5.3 | banq jivejdonJivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by… | |
| CVE-2026-107831 | 8 Oct 2026 | CVSS 4.3 | banq jivejdonJivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing… | |
| CVE-2026-107726 | 8 Oct 2026 | CVSS 9.3 | Hazelcast allows arbitrary member memory access by low-privileged clientHazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper… | Fix |
| CVE-2026-107792 | 8 Oct 2026 | CVSS 4.3 | banq jivejdonJivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows… | |
| CVE-2026-107793 | 8 Oct 2026 | CVSS 4.3 | banq jivejdonJivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to… | |
| CVE-2026-107796 | 8 Oct 2026 | CVSS 6.1 | banq jivejdonJivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in… | |
| CVE-2026-107797 | 8 Oct 2026 | CVSS 6.1 | banq jivejdonJivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject… | |
| CVE-2026-107798 | 8 Oct 2026 | CVSS 5.4 | banq jivejdonjivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter… | |
| CVE-2026-107720 | 8 Oct 2026 | CVSS 7.4 | fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setfast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty… | Fix |
| CVE-2026-107721 | 8 Oct 2026 | CVSS 5.9 | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its… | Fix |
| CVE-2026-107722 | 8 Oct 2026 | CVSS 9.8 | fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionfast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret… | Fix |
| CVE-2026-107723 | 8 Oct 2026 | CVSS 8.1 | fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayfast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a… | Fix |
| CVE-2026-107724 | 8 Oct 2026 | CVSS 7.4 | fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryfast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret… | Fix |
| CVE-2026-107725 | 8 Oct 2026 | CVSS 8.7 | Hazelcast has an authorization bypass in IMap Predicates APIHazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing… | Fix |
| CVE-2026-107714 | 8 Oct 2026 | CVSS 5.9 | sparklemotion mechanizeThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as… | |
| CVE-2026-107715 | 8 Oct 2026 | CVSS 6.8 | Mechanize sends credential headers to another host after an HTTP redirectThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a… | Fix |
| CVE-2026-107716 | 8 Oct 2026 | CVSS 7.3 | Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistryBanks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links… | Fix |
| CVE-2026-107717 | 8 Oct 2026 | CVSS 6.5 | Banks: User-controlled prompt input can be parsed as privileged chat messagesBanks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of… | Fix |
| CVE-2026-107718 | 8 Oct 2026 | CVSS 6.1 | AdonisJS: Unencoded route parameters can produce open redirectsAdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route… | Fix |
| CVE-2026-107719 | 8 Oct 2026 | CVSS 4.2 | fast-jwt: Verifier cache accepts expired JWTs without iat.fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously… | Fix |
| CVE-2025-71428 | 8 Oct 2026 | CVSS 4.9 | banq jivejdonJivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to… | |
| CVE-2026-104628 | 8 Oct 2026 | CVSS 6.5 | Satel Netco DesignSatel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer… | |
| CVE-2026-105269 | 8 Oct 2026 | CVSS 6.8 | Satel Netco DesignSatel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator… | |
| CVE-2026-105275 | 8 Oct 2026 | CVSS 4.3 | Satel Netco DesignSatel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user… | |
| CVE-2026-107399 | 8 Oct 2026 | CVSS 6.8 | Mechanize sends credential headers to another origin after a meta refreshThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in… | Fix |
Page 99 of 168