CVE-2026-103350 | Medium | 5.3 | 2026-10-15 | Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allow… |
CVE-2026-102184 | High | 7.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos Evolved platfor… |
CVE-2026-102183 | High | 7.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allo… |
CVE-2026-102067 | Medium | 6.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allo… |
CVE-2026-102065 | High | 7.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allo… |
CVE-2026-102033 | Medium | 6.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in l2ald of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to c… |
CVE-2026-102019 | Medium | 6.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos Evolved allows an unauthenticated… |
CVE-2026-102016 | High | 7.5 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured BG… |
CVE-2026-101995 | Medium | 4.3 | 2026-10-14 | An Improper Validation of Specified Quantity in Input vulnerability in the
l2ald
of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attac… |
CVE-2026-101985 | Medium | 6.5 | 2026-10-14 | A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series allo… |
CVE-2026-109380 | High | 7.5 | 2026-10-12 | modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by r… |
CVE-2026-107429 | Medium | 4.3 | 2026-10-12 | Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulatio… |
CVE-2026-106605 | Medium | 5.3 | 2026-10-12 | Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-… |
CVE-2026-107434 | Medium | 5.4 | 2026-10-10 | Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. |
CVE-2026-103501 | | | 2026-10-10 | Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
When deserializing a sketch in LIST mode, from eit… |
CVE-2026-107565 | Medium | 5.1 | 2026-10-08 | A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS… |
CVE-2026-105754 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path acc… |
CVE-2026-97275 | Medium | 5.3 | 2026-10-05 | Improper Validation of Specified Quantity in Input vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-build… |
CVE-2026-103351 | Medium | 5.3 | 2026-10-05 | Improper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Input… |
CVE-2026-103065 | High | 8.2 | 2026-10-03 | Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2026-94646 | | | 2026-10-02 | Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution… |
CVE-2026-94636 | | | 2026-10-02 | Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity… |
CVE-2026-94645 | | | 2026-10-02 | Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings.
Thi… |
CVE-2026-91137 | | | 2026-10-02 | Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PH… |
CVE-2026-102514 | | | 2026-10-01 | Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier al… |
CVE-2026-103484 | High | 8.8 | 2026-10-01 | IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution. |
CVE-2026-102111 | Medium | 4.9 | 2026-09-30 | Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside i… |
CVE-2026-62083 | Medium | 5.4 | 2026-09-30 | Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions. |
CVE-2026-86133 | High | 7.5 | 2026-09-30 | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to cr… |
CVE-2026-102730 | | | 2026-09-29 | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation… |
CVE-2026-102711 | | | 2026-09-29 | Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_memory_load` / `_tx… |
CVE-2026-75806 | Medium | 5.3 | 2026-09-29 | Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
can be terminated by a single unauthenticated datagram whose encrypted
fragment i… |
CVE-2026-97057 | High | 7.5 | 2026-09-24 | redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supp… |
CVE-2026-12974 | | | 2026-09-23 | A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).
This issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through… |
CVE-2026-94450 | High | 7.5 | 2026-09-22 | Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of servic… |
CVE-2026-93345 | High | 7.5 | 2026-09-22 | MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an… |
CVE-2026-89420 | | | 2026-09-22 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open payment channel to obtain paid resources without being charge… |
CVE-2026-76899 | Medium | 5.7 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/pag… |
CVE-2026-93749 | High | 7.5 | 2026-09-18 | source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values… |
CVE-2025-36178 | Medium | 5.4 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation… |
CVE-2026-48977 | | | 2026-09-17 | OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana… |
CVE-2026-50285 | High | 7.5 | 2026-09-17 | Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-control… |
CVE-2026-93015 | Medium | 6.3 | 2026-09-17 | BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can… |
CVE-2026-73436 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor ma… |
CVE-2026-83115 | High | 7.5 | 2026-09-15 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). Supported versions that are affect… |
CVE-2026-69210 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Inte… |
CVE-2026-76442 | High | 7.5 | 2026-09-14 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineer… |
CVE-2024-53922 | Medium | 5.7 | 2026-09-14 | An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial… |
CVE-2026-87962 | High | 7.5 | 2026-09-10 | t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and capacity fields from s… |
CVE-2026-87735 | Medium | 4.3 | 2026-09-09 | An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or… |
CVE-2026-87470 | Critical | 9.6 | 2026-09-09 | Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside… |
CVE-2026-16025 | High | 7.5 | 2026-09-08 | Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Modu… |
CVE-2026-79376 | High | 8.8 | 2026-09-08 | An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of… |
CVE-2026-85201 | | | 2026-09-07 | In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a workload in a length-delimited protobuf message received thr… |
CVE-2026-82751 | | | 2026-09-06 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored pay… |
CVE-2026-82750 | | | 2026-09-06 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored pay… |
CVE-2026-82752 | | | 2026-09-05 | Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose… |
CVE-2026-53720 | | | 2026-09-03 | pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the ca… |
CVE-2026-71562 | | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availabilit… |
CVE-2026-70409 | | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by r… |
CVE-2026-70405 | | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sending an SNMP message… |
CVE-2026-59696 | | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade availability by supplying a URI whose… |
CVE-2026-82734 | | | 2026-09-01 | Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to submit a non-finite decimal value that bypasses numer… |
CVE-2026-82397 | High | 7.5 | 2026-08-31 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with url… |
CVE-2026-81779 | Critical | 10.0 | 2026-08-31 | Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted.
This issue affects Newspaper… |
CVE-2026-76763 | High | 7.5 | 2026-08-31 | A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthen… |
CVE-2026-19873 | High | 7.5 | 2026-08-31 | HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements.
When a Repea… |
CVE-2026-78010 | | | 2026-08-28 | A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service… |
CVE-2026-81851 | | | 2026-08-28 | A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a d… |
CVE-2026-6876 | | | 2026-08-27 | ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated… |
CVE-2026-59317 | Medium | 6.5 | 2026-08-27 | DeadLetterPublishingRecovererFactory reads the retry_topic-original-timestamp header from an inbound ConsumerRecord and passes its raw bytes directly to new Bi… |
CVE-2026-45201 | High | 7.8 | 2026-08-21 | Software installed and run as a non-privileged user may conduct improper GPU system calls to pass invalid log2 page size when allocating physical pages leading… |
CVE-2026-77640 | Low | 3.7 | 2026-08-20 | tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END… |
CVE-2026-53587 | High | 7.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-60820 | High | 7.4 | 2026-08-18 | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to e… |
CVE-2026-75897 | High | 7.5 | 2026-08-18 | Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote atta… |
CVE-2026-66679 | Medium | 6.5 | 2026-08-18 | Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. |
CVE-2026-73194 | Critical | 9.1 | 2026-08-15 | DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
preparse… |
CVE-2026-19639 | Medium | 4.3 | 2026-08-14 | An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their ass… |
CVE-2026-53794 | Medium | 5.3 | 2026-08-13 | rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity chec… |
CVE-2026-19566 | High | 7.5 | 2026-08-12 | Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IPv6 prefix lengths.
The _encode method accepts an… |
CVE-2026-19518 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manipulation. |
CVE-2026-19517 | Medium | 6.5 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerability in Samsung Open Source rlottie allows… |
CVE-2026-71394 | | | 2026-08-10 | GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the… |
CVE-2026-19028 | | | 2026-08-06 | H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 prior to 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the… |
CVE-2026-19026 | | | 2026-08-05 | H5Z__filter_nbit in H5Znbit.c in HDF5 prior to 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_ne… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-20313 | High | 7.7 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-70378 | High | 7.5 | 2026-08-05 | imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes… |
CVE-2026-40272 | High | 7.0 | 2026-07-29 | Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to e… |
CVE-2026-54890 | High | 7.5 | 2026-07-27 | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Ex… |
CVE-2026-59532 | High | 7.5 | 2026-07-27 | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. |
CVE-2026-59531 | High | 7.5 | 2026-07-27 | Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. |
CVE-2026-58662 | Critical | 9.1 | 2026-07-27 | Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0… |
CVE-2026-66374 | High | 8.1 | 2026-07-25 | Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path. |
CVE-2026-11721 | High | 7.5 | 2026-07-22 | It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. Th… |
CVE-2026-10822 | Medium | 6.5 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit.
BIND will first… |
CVE-2026-32665 | High | 7.5 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC conn… |
CVE-2026-47667 | High | 7.5 | 2026-07-21 | CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the fi… |
CVE-2026-59695 | | | 2026-07-17 | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by… |