CVE-2026-104364 | Low | 3.3 | 2026-10-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation. |
CVE-2026-57143 | High | 8.8 | 2026-10-12 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the search_web SearxNG provider pass the LLM-controlled searxng_ur… |
CVE-2026-94451 | Medium | 6.5 | 2026-10-12 | Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly c… |
CVE-2026-109311 | Medium | 6.5 | 2026-10-12 | vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authen… |
CVE-2026-93693 | Medium | 6.5 | 2026-10-12 | In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response fo… |
CVE-2026-21125 | | | 2026-10-12 | Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute… |
CVE-2026-21124 | | | 2026-10-12 | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially exe… |
CVE-2026-87765 | Medium | 5.5 | 2026-10-12 | In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index… |
CVE-2026-66085 | Medium | 5.5 | 2026-10-12 | In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure… |
CVE-2026-107825 | Medium | 4.0 | 2026-10-09 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go h… |
CVE-2026-48484 | Medium | 6.5 | 2026-10-09 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/f… |
CVE-2026-103413 | High | 8.8 | 2026-10-09 | Improper input validation vulnerability in Apache Camel Karavan.
When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and appli… |
CVE-2026-107734 | | | 2026-10-08 | SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in… |
CVE-2026-107726 | | | 2026-10-08 | Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of da… |
CVE-2026-107720 | High | 7.4 | 2026-10-08 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null… |
CVE-2026-107717 | Medium | 6.5 | 2026-10-08 | Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered… |
CVE-2026-88257 | | | 2026-10-08 | Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments tha… |
CVE-2026-93509 | Medium | 6.5 | 2026-10-08 | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new bala… |
CVE-2023-5649 | | | 2026-10-08 | An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide in… |
CVE-2026-76279 | Medium | 4.3 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search… |
CVE-2026-76277 | Medium | 4.1 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk us… |
CVE-2026-76273 | Medium | 4.3 | 2026-10-07 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search… |
CVE-2026-107225 | Medium | 6.5 | 2026-10-07 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font extraction pred… |
CVE-2026-76468 | High | 8.2 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal s… |
CVE-2026-76456 | High | 8.6 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal securi… |
CVE-2026-107278 | | | 2026-10-07 | MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the origina… |
CVE-2026-106563 | Medium | 5.3 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity… |
CVE-2026-106491 | Medium | 6.4 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input valid… |
CVE-2026-106512 | | | 2026-10-06 | The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied fi… |
CVE-2026-106443 | High | 8.8 | 2026-10-06 | WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img… |
CVE-2026-106414 | Critical | 9.6 | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially ex… |
CVE-2026-106396 | Medium | 5.4 | 2026-10-06 | Improper input validation in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass we… |
CVE-2026-106353 | Medium | 6.5 | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web ori… |
CVE-2026-106331 | Medium | 6.5 | 2026-10-06 | Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin po… |
CVE-2026-106299 | Medium | 5.4 | 2026-10-06 | Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass syst… |
CVE-2026-106263 | Medium | 6.5 | 2026-10-06 | Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access res… |
CVE-2026-106226 | Medium | 4.2 | 2026-10-06 | Improper input validation in Compositing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof ad… |
CVE-2026-106206 | Medium | 5.9 | 2026-10-06 | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted net… |
CVE-2026-106185 | Medium | 6.5 | 2026-10-06 | Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system ac… |
CVE-2025-71383 | Critical | 9.8 | 2026-10-06 | Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or pas… |
CVE-2026-34498 | | | 2026-10-06 | Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection.
This issue affects Illustra… |
CVE-2026-56596 | Low | 3.5 | 2026-10-06 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data… |
CVE-2026-105757 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and… |
CVE-2026-105756 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value withou… |
CVE-2026-105754 | Medium | 6.5 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path acc… |
CVE-2026-58834 | Medium | 5.5 | 2026-10-05 | In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input validation. This could le… |
CVE-2026-55269 | High | 7.8 | 2026-10-05 | In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of pr… |
CVE-2026-28640 | High | 7.8 | 2026-10-05 | In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This co… |
CVE-2026-101919 | High | 8.8 | 2026-10-05 | A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged contr… |
CVE-2026-104811 | | | 2026-10-05 | DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication… |
CVE-2026-105117 | Medium | 6.1 | 2026-10-03 | OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email wording via the forg… |
CVE-2026-63569 | | | 2026-10-02 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows… |
CVE-2025-31980 | Medium | 4.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data in… |
CVE-2026-55094 | | | 2026-09-30 | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vuln… |
CVE-2026-47547 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful… |
CVE-2026-47546 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause improper input validation. A successful… |
CVE-2026-47543 | Medium | 6.7 | 2026-09-30 | VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A suc… |
CVE-2026-47542 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A su… |
CVE-2026-47522 | Medium | 6.7 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause improper input validation. A su… |
CVE-2026-103389 | | | 2026-09-30 | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any s… |
CVE-2026-103321 | | | 2026-09-30 | MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature.
The event graph preview image field was accepted and stored w… |
CVE-2026-85532 | High | 7.5 | 2026-09-30 | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive C… |
CVE-2026-93995 | Medium | 6.5 | 2026-09-30 | Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache
MINA SSHD is a Java library for client-side… |
CVE-2026-103237 | | | 2026-09-30 | MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event ed… |
CVE-2026-102823 | High | 7.5 | 2026-09-29 | Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTEN… |
CVE-2026-95382 | Medium | 6.5 | 2026-09-29 | Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-95381 | High | 8.3 | 2026-09-29 | Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-95364 | Medium | 5.4 | 2026-09-29 | Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromiu… |
CVE-2026-95341 | High | 8.3 | 2026-09-29 | Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-95276 | High | 8.3 | 2026-09-29 | Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially e… |
CVE-2026-102677 | High | 7.8 | 2026-09-29 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, E… |
CVE-2026-102600 | High | 7.5 | 2026-09-29 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited object properties wh… |
CVE-2026-100787 | Critical | 9.6 | 2026-09-29 | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
CVE-2026-101266 | | | 2026-09-29 | A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps. |
CVE-2026-97027 | Low | 3.6 | 2026-09-28 | Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files… |
CVE-2026-100370 | Medium | 4.7 | 2026-09-28 | DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting dangerous URL values… |
CVE-2026-96760 | Critical | 9.8 | 2026-09-28 | Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization… |
CVE-2026-13018 | Medium | 4.3 | 2026-09-28 | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds mem… |
CVE-2026-101131 | Low | 3.3 | 2026-09-28 | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of t… |
CVE-2026-54710 | | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module du… |
CVE-2026-12342 | Critical | 9.6 | 2026-09-28 | This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated user remote
code execution on the IdentityIQ server due to improper input v… |
CVE-2026-101079 | Low | 2.8 | 2026-09-28 | A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/… |
CVE-2026-12268 | High | 8.8 | 2026-09-28 | ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution. |
CVE-2026-12267 | High | 7.2 | 2026-09-28 | ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execu… |
CVE-2026-101015 | High | 7.3 | 2026-09-28 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the compone… |
CVE-2026-100902 | Medium | 6.5 | 2026-09-28 | A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper… |
CVE-2026-88774 | High | 7.2 | 2026-09-27 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and… |
CVE-2026-88771 | Critical | 9.8 | 2026-09-27 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, be… |
CVE-2026-101041 | | | 2026-09-27 | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition… |
CVE-2026-100833 | Critical | 9.6 | 2026-09-27 | Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase dur… |
CVE-2026-100699 | Medium | 5.3 | 2026-09-26 | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresses whose local-part… |
CVE-2026-100664 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host hea… |
CVE-2026-100663 | High | 7.5 | 2026-09-26 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets whe… |
CVE-2026-100652 | Medium | 5.9 | 2026-09-26 | vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against vocabulary bounds in Rust HTTP and gRPC frontends, allowing out-of-vocabulary token… |
CVE-2026-100647 | Medium | 5.3 | 2026-09-26 | vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, wh… |
CVE-2026-63206 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's HTML sanitizer, which blocks remote images in ticket articles and… |
CVE-2026-84462 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a security filter that protects Zammad's AI Agent configuration can be bypa… |
CVE-2026-56732 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, vulnerability in Zammad's HTML sanitization allows injection of specific HT… |
CVE-2026-94445 | High | 8.8 | 2026-09-25 | A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem.
Disjointly, one of the… |
CVE-2026-67234 | | | 2026-09-25 | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or pref… |