CVE-2026-106491 | Medium | 6.4 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input valid… |
CVE-2026-106512 | | | 2026-10-06 | The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied fi… |
CVE-2026-106443 | High | 8.8 | 2026-10-06 | WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img… |
CVE-2026-106414 | Critical | 9.6 | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially ex… |
CVE-2026-106396 | | | 2026-10-06 | Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass we… |
CVE-2026-106353 | | | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web ori… |
CVE-2026-106331 | | | 2026-10-06 | Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin po… |
CVE-2026-106299 | | | 2026-10-06 | Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass syst… |
CVE-2026-106263 | | | 2026-10-06 | Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access res… |
CVE-2026-106226 | | | 2026-10-06 | Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof ad… |
CVE-2026-106206 | Medium | 5.9 | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted net… |
CVE-2026-106185 | | | 2026-10-06 | Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system ac… |
CVE-2026-34498 | | | 2026-10-06 | Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra… |
CVE-2026-56596 | Low | 3.5 | 2026-10-06 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data… |
CVE-2026-105757 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and… |
CVE-2026-105756 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value withou… |
CVE-2026-105754 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path acc… |
CVE-2026-58834 | Medium | 5.5 | 2026-10-05 | In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could le… |
CVE-2026-55269 | High | 7.8 | 2026-10-05 | In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of pr… |
CVE-2026-28640 | High | 7.8 | 2026-10-05 | In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This co… |
CVE-2026-101919 | High | 8.8 | 2026-10-05 | A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged contr… |
CVE-2026-104811 | | | 2026-10-05 | DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication… |
CVE-2026-105117 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forg… |
CVE-2026-63569 | | | 2026-10-02 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows… |
CVE-2025-31980 | Medium | 4.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data in… |
CVE-2026-55094 | | | 2026-09-30 | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vuln… |
CVE-2026-47547 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful… |
CVE-2026-47546 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful… |
CVE-2026-47543 | Medium | 6.7 | 2026-09-30 | VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A suc… |
CVE-2026-47542 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A su… |
CVE-2026-47522 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A su… |
CVE-2026-103389 | | | 2026-09-30 | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any s… |
CVE-2026-103321 | | | 2026-09-30 | MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored w… |
CVE-2026-85532 | High | 7.5 | 2026-09-30 | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive C… |
CVE-2026-93995 | Medium | 6.5 | 2026-09-30 | Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache
MINA SSHD is a Java library for client-side… |
CVE-2026-103237 | | | 2026-09-30 | MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event ed… |
CVE-2026-102823 | High | 7.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTEN… |
CVE-2026-95382 | Medium | 6.5 | 2026-09-29 | Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-95381 | High | 8.3 | 2026-09-29 | Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-95364 | Medium | 5.4 | 2026-09-29 | Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromiu… |
CVE-2026-95341 | High | 8.3 | 2026-09-29 | Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-95276 | High | 8.3 | 2026-09-29 | Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially e… |
CVE-2026-102677 | High | 7.8 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, E… |
CVE-2026-102600 | High | 7.5 | 2026-09-29 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties wh… |
CVE-2026-100787 | Critical | 9.6 | 2026-09-29 | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-101266 | | | 2026-09-29 | A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps. |
CVE-2026-97027 | Low | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files… |
CVE-2026-100370 | Medium | 4.7 | 2026-09-28 | DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values… |
CVE-2026-96760 | Critical | 9.8 | 2026-09-28 | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization… |
CVE-2026-13018 | Medium | 4.3 | 2026-09-28 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds mem… |
CVE-2026-101131 | Low | 3.3 | 2026-09-28 | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of t… |
CVE-2026-54710 | | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module du… |
CVE-2026-12342 | Critical | 9.6 | 2026-09-28 | This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated user remote
code execution on the IdentityIQ server due to improper input v… |
CVE-2026-101079 | Low | 2.8 | 2026-09-28 | A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/… |
CVE-2026-12268 | High | 8.8 | 2026-09-28 | ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution. |
CVE-2026-12267 | High | 7.2 | 2026-09-28 | ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execu… |
CVE-2026-101015 | High | 7.3 | 2026-09-28 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the compone… |
CVE-2026-100902 | Medium | 6.5 | 2026-09-28 | A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper… |
CVE-2026-88774 | High | 7.2 | 2026-09-27 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and… |
CVE-2026-88771 | Critical | 9.8 | 2026-09-27 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, be… |
CVE-2026-101041 | | | 2026-09-27 | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition… |
CVE-2026-100833 | High | 8.2 | 2026-09-27 | Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase dur… |
CVE-2026-100699 | Medium | 5.3 | 2026-09-26 | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part… |
CVE-2026-100664 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host hea… |
CVE-2026-100663 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets whe… |
CVE-2026-100652 | Medium | 5.9 | 2026-09-26 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
CVE-2026-100647 | Medium | 5.3 | 2026-09-26 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, wh… |
CVE-2026-63206 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and… |
CVE-2026-84462 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |
CVE-2026-56732 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HT… |
CVE-2026-94445 | High | 8.8 | 2026-09-25 | A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the… |
CVE-2026-67234 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or pref… |
CVE-2026-97869 | Medium | 4.1 | 2026-09-25 | A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson o… |
CVE-2026-97865 | High | 7.3 | 2026-09-25 | A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Rem… |
CVE-2026-85750 | High | 7.2 | 2026-09-25 | Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficien… |
CVE-2026-100187 | | | 2026-09-25 | The Onion module in AIL Framework contained a performance shortcut in its URL extraction logic that accepted URLs as valid .onion targets based solely on a len… |
CVE-2026-100177 | | | 2026-09-25 | The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attac… |
CVE-2026-91134 | Medium | 5.4 | 2026-09-24 | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origi… |
CVE-2026-47132 | Medium | 5.4 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat use… |
CVE-2025-32000 | Medium | 4.3 | 2026-09-24 | HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or expl… |
CVE-2026-51997 | High | 8.8 | 2026-09-24 | An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions |
CVE-2026-77797 | Low | 3.6 | 2026-09-24 | Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. |
CVE-2026-17503 | Medium | 5.1 | 2026-09-24 | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vu… |
CVE-2026-97182 | High | 7.3 | 2026-09-24 | A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo… |
CVE-2026-82407 | | | 2026-09-23 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator up… |
CVE-2026-95843 | High | 7.5 | 2026-09-23 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractSh… |
CVE-2026-62998 | Medium | 4.3 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter… |
CVE-2026-86683 | High | 8.1 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings. |
CVE-2026-86679 | High | 7.1 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to de… |
CVE-2026-76980 | High | 7.4 | 2026-09-23 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer sys… |
CVE-2026-87071 | Medium | 5.3 | 2026-09-23 | The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPre… |
CVE-2026-95928 | Medium | 5.5 | 2026-09-23 | A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsre… |
CVE-2026-95897 | Medium | 5.5 | 2026-09-23 | A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loa… |
CVE-2026-76711 | High | 7.5 | 2026-09-22 | A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unau… |
CVE-2026-63628 | | | 2026-09-22 | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.ts copied a client-s… |
CVE-2026-63627 | | | 2026-09-22 | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, FeePayerPolicy in src/tempo/internal/fee-payer.ts used decodeFunctionData to vali… |
CVE-2026-81995 | Critical | 9.1 | 2026-09-22 | Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of th… |
CVE-2026-76194 | Medium | 4.3 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-75686 | Critical | 9.3 | 2026-09-22 | Adobe Connect is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An at… |
CVE-2026-75638 | Medium | 6.5 | 2026-09-22 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |