CVE-2026-117574 - CVSS 9.1 (critical), 2026-10-28: A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another…
CVE-2026-63190 - CVSS 9.4 (critical), 2026-10-28: FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under…
CVE-2026-118264 - CVSS 9.1 (critical), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before…
CVE-2026-118633 - CVSS 9.2 (critical), 2026-10-28: A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race…
CVE-2026-103409 - CVSS 9.8 (critical), 2026-10-28: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to…
CVE-2026-103406 - CVSS 9.8 (critical), 2026-10-28: An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor…
CVE-2026-44179 - CVSS 9.9 (critical), 2026-10-28: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include`…
CVE-2026-115968 - CVSS 9.8 (critical), 2026-10-28: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member:…
CVE-2026-105420 - CVSS 9.4 (critical), 2026-10-28: Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to…
CVE-2026-111411 - CVSS 9.3 (critical), 2026-10-28: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations…
CVE-2026-115607 - CVSS 9.3 (critical), 2026-10-28: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL…
CVE-2026-115904 - CVSS 9.6 (critical), 2026-10-28: Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are…
CVE-2026-67074 - CVSS 9.1 (critical), 2026-10-28: HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application…
CVE-2026-114278 - CVSS 9.8 (critical), 2026-10-28: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and…
CVE-2026-118477 - CVSS 9.8 (critical), 2026-10-28: The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFast is vulnerable to OS Command Injection. This OS Command Injection…
CVE-2026-103792 - CVSS 9.6 (critical), 2026-10-28: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…
CVE-2026-103799 - CVSS 9.6 (critical), 2026-10-28: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…
CVE-2026-112197 - CVSS 9.4 (critical), 2026-10-28: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the…
CVE-2026-103780 - CVSS 9.8 (critical), 2026-10-28: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…
CVE-2026-86384 - CVSS 9.8 (critical), 2026-10-28: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…
CVE-2026-14571 - CVSS 9.1 (critical), 2026-10-28: A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided…
CVE-2026-86397 - CVSS 9.8 (critical), 2026-10-28: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…
CVE-2026-86400 - CVSS 9.8 (critical), 2026-10-28: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…
CVE-2026-90717 - CVSS 9.1 (critical), 2026-10-28: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025…
CVE-2026-109218 - CVSS 9.8 (critical), 2026-10-28: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This…
Known exploited vulnerabilities (CISA KEV)
CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
CVE-2026-48356 - CVSS 9.3 (critical), 2026-07-14: Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of…
CVE-2026-109619 - CVSS 9.2 (critical), 2026-10-21: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
CVE-2026-109618 - CVSS 9.8 (critical), 2026-10-21: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for…
CVE-2026-114625 - CVSS 9.9 (critical), 2026-10-22: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
CVE-2026-110447 - CVSS 9.8 (critical), 2026-10-14: Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in…
CVE-2026-110936 - CVSS 8.4 (high), 2026-10-15: A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an…
CVE-2026-106931 - CVSS 8.5 (high), 2026-10-14: SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM…
CVE-2026-96656 - CVSS 8.6 (high), 2026-09-23: Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is…
CVE-2026-96655 - CVSS 5.3 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal'…
CVE-2026-96654 - CVSS 6.9 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions…
CVE-2026-96652 - CVSS 5.3 (medium), 2026-09-23: Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol'…
CVE-2026-102764 - CVSS 9.8 (critical), 2026-10-15: The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the…
CVE-2025-61624 - CVSS 6.5 (medium), 2026-04-14: An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS…
CVE-2026-21589 - CVSS 9.3 (critical), 2026-10-05: This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
CVE-2026-0322 - CVSS 8.6 (high), 2026-10-14: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network…
CVE-2026-76519 - CVSS 9.8 (critical), 2026-10-14: A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write…
CVE-2026-105134 - CVSS 10 (critical), 2026-10-04: A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the…
CVE-2026-105133 - CVSS 7.3 (high), 2026-10-04: A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file…
CVE-2026-96951 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security…
CVE-2026-104935 - CVSS 8.6 (high), 2026-10-13: Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
CVE-2023-22894 - CVSS 7.2 (high), 2023-04-19: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…
CVE-2021-3199 - CVSS 9.8 (critical), 2021-01-26: Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an…
CVE-2016-3081 - CVSS 8.1 (high), 2016-04-26: Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute…
CVE-2015-5477 - CVSS 7.5 (high), 2015-07-29: named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon…
Newest CVEs
CVE-2026-118667 - CVSS 4.3 (medium), 2026-10-28: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From…
CVE-2026-118666 - CVSS 6 (medium), 2026-10-28: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor…
CVE-2026-118665 - CVSS 8.2 (high), 2026-10-28: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor…
CVE-2026-118664 - CVSS 8.2 (high), 2026-10-28: decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to…
CVE-2026-118663 - CVSS 5.3 (medium), 2026-10-28: @hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has…
CVE-2026-118662 - CVSS 6.9 (medium), 2026-10-28: Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader…
CVE-2026-118661 - CVSS 6.5 (medium), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in…
CVE-2026-118660 - CVSS 8.6 (high), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link…
CVE-2026-118659 - CVSS 7.5 (high), 2026-10-28: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Happy DOM server-renderer package's…
CVE-2026-118658 - CVSS 4.7 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without…
CVE-2026-118657 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches…
CVE-2026-118656 - CVSS 6.1 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with…
CVE-2026-76418 - CVSS 8.6 (high), 2026-10-28: A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
CVE-2026-118655 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded…
CVE-2026-117574 - CVSS 9.1 (critical), 2026-10-28: A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another…
CVE-2026-118654 - CVSS 5.9 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a…
CVE-2026-13451 - CVSS 7.7 (high), 2026-10-28: A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by…
CVE-2026-61542 - CVSS 8.6 (high), 2026-10-28: Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected component, has an…
CVE-2026-54162 - CVSS 4.7 (medium), 2026-10-28: Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log…
CVE-2026-61529 - CVSS 4.7 (medium), 2026-10-28: Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint…
CVE-2026-118653 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is…
CVE-2026-118652 - CVSS 6.1 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript…
CVE-2026-115415 - CVSS 6.5 (medium), 2026-10-28: Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the…
CVE-2026-118651 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream…
CVE-2026-63190 - CVSS 9.4 (critical), 2026-10-28: FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under…
CVE-2026-118650 - CVSS 7.5 (high), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from…
CVE-2026-118266 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request.…
CVE-2026-78674 - CVSS 8.8 (high), 2026-10-28: The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can lead to the…
CVE-2026-6647 - CVSS 7.4 (high), 2026-10-28: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismatches in username…
CVE-2026-3583 - CVSS 3.1 (low), 2026-10-28: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a…
CVE-2026-11854 - CVSS 6.1 (medium), 2026-10-28: The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding.…
CVE-2025-14260 - CVSS 8.3 (high), 2026-10-28: Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing…
CVE-2026-109411 - CVSS 8.1 (high), 2026-10-28: An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or…
CVE-2026-118265 - CVSS 5.3 (medium), 2026-10-28: Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a…
CVE-2026-118264 - CVSS 9.1 (critical), 2026-10-28: Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before…
CVE-2026-118263 - CVSS 6.3 (medium), 2026-10-28: Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when…
CVE-2026-118262 - CVSS 8.2 (high), 2026-10-28: Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a…
CVE-2026-118688 - CVSS 8.8 (high), 2026-10-28: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat…
CVE-2026-118687 - CVSS 8.3 (high), 2026-10-28: Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE…
CVE-2026-118686 - CVSS 8.7 (high), 2026-10-28: EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API…
CVE-2026-118685 - CVSS 6.9 (medium), 2026-10-28: ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting 'false' as truthy,…
CVE-2026-118684 - CVSS 8.2 (high), 2026-10-28: MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is None, with MD5 as…
CVE-2026-118683 - CVSS 8.8 (high), 2026-10-28: MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to…
CVE-2026-118681 - CVSS 6.3 (medium), 2026-10-28: go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the live routing context and leaves a mounted…
CVE-2026-118680 - CVSS 5.9 (medium), 2026-10-28: SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke…
CVE-2026-118679 - CVSS 7.5 (high), 2026-10-28: n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated…
CVE-2026-118678 - CVSS 7.1 (high), 2026-10-28: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by…
CVE-2026-118677 - CVSS 5.9 (medium), 2026-10-28: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect…
CVE-2026-118676 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by…
CVE-2026-118675 - CVSS 7.1 (high), 2026-10-28: n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials…
