CVE-2026-93677 | High | 7.7 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to a… |
CVE-2026-97626 | | | 2026-10-06 | Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the… |
CVE-2026-106501 | Critical | 9.6 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affe… |
CVE-2026-106459 | High | 8.5 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affect… |
CVE-2026-106424 | | | 2026-10-06 | Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the… |
CVE-2026-106415 | | | 2026-10-06 | Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromi… |
CVE-2026-106392 | Medium | 4.3 | 2026-10-06 | Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (… |
CVE-2026-106360 | Medium | 4.3 | 2026-10-06 | Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium s… |
CVE-2026-106348 | | | 2026-10-06 | Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromiu… |
CVE-2026-106342 | High | 8.8 | 2026-10-06 | Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromi… |
CVE-2026-106334 | High | 8.8 | 2026-10-06 | Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information vi… |
CVE-2026-106330 | | | 2026-10-06 | Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium se… |
CVE-2026-106321 | | | 2026-10-06 | Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a… |
CVE-2026-106277 | Medium | 4.3 | 2026-10-06 | Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium se… |
CVE-2026-106256 | High | 8.8 | 2026-10-06 | Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive… |
CVE-2026-106254 | Medium | 5.1 | 2026-10-06 | Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed ap… |
CVE-2026-106242 | | | 2026-10-06 | Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive inf… |
CVE-2026-106237 | | | 2026-10-06 | Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium s… |
CVE-2026-106220 | High | 8.8 | 2026-10-06 | Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-106214 | Medium | 5.3 | 2026-10-06 | Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted networ… |
CVE-2026-106192 | Medium | 4.6 | 2026-10-06 | Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chr… |
CVE-2026-106120 | | | 2026-10-06 | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict i… |
CVE-2026-95153 | Medium | 4.9 | 2026-10-06 | An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints |
CVE-2026-105861 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrie… |
CVE-2026-105853 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token re… |
CVE-2026-105847 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user w… |
CVE-2026-105805 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user w… |
CVE-2026-86786 | Medium | 5.3 | 2026-10-06 | The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users… |
CVE-2026-105707 | Medium | 5.3 | 2026-10-06 | A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler… |
CVE-2026-105752 | Low | 3.1 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests… |
CVE-2026-105748 | Medium | 4.3 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the I… |
CVE-2026-105684 | Medium | 4.3 | 2026-10-05 | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check… |
CVE-2026-105639 | Critical | 9.8 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-ban… |
CVE-2026-105635 | High | 7.4 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permis… |
CVE-2026-104963 | Medium | 4.3 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/{sl… |
CVE-2026-63270 | | | 2026-10-05 | URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server… |
CVE-2026-63269 | | | 2026-10-05 | LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that mad… |
CVE-2026-63268 | | | 2026-10-05 | LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local t… |
CVE-2026-63267 | | | 2026-10-05 | LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded… |
CVE-2026-105302 | Medium | 5.7 | 2026-10-05 | A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate… |
CVE-2026-105211 | High | 8.1 | 2026-10-04 | ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP… |
CVE-2026-105205 | Medium | 5.3 | 2026-10-04 | SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from pas… |
CVE-2026-105145 | Medium | 5.3 | 2026-10-04 | A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file goldenverba/components… |
CVE-2026-86817 | Medium | 4.9 | 2026-10-04 | The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema field default values, a… |
CVE-2026-105098 | Medium | 4.3 | 2026-10-04 | A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. Affected is an unknown function of the file /ticket/customer of the component Support… |
CVE-2026-105120 | Medium | 4.9 | 2026-10-03 | OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administrators to list sess… |
CVE-2026-71883 | | | 2026-10-03 | In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and… |
CVE-2026-96962 | Low | 3.7 | 2026-10-03 | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid in… |
CVE-2026-86834 | Low | 3.7 | 2026-10-03 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpo… |
CVE-2026-86832 | Medium | 5.3 | 2026-10-03 | The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter info… |
CVE-2026-80518 | Low | 3.7 | 2026-10-03 | The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes u… |
CVE-2026-100149 | Medium | 5.3 | 2026-10-03 | The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2026-105030 | Medium | 5.3 | 2026-10-03 | Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by… |
CVE-2026-104476 | Medium | 5.9 | 2026-10-03 | Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives lef… |
CVE-2026-12392 | Medium | 5.3 | 2026-10-02 | An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retriev… |
CVE-2026-103627 | Medium | 6.5 | 2026-10-02 | Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium se… |
CVE-2026-104455 | Medium | 5.3 | 2026-10-02 | YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchange… |
CVE-2026-103763 | Medium | 5.8 | 2026-10-02 | SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents thr… |
CVE-2026-102002 | Low | 3.1 | 2026-10-02 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio… |
CVE-2026-97317 | Medium | 5.3 | 2026-10-02 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in pub… |
CVE-2026-90988 | Medium | 5.3 | 2026-10-02 | The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticat… |
CVE-2026-64892 | | | 2026-10-01 | - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations.
This issue affects Easy… |
CVE-2026-67172 | Low | 3.7 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when inval… |
CVE-2026-67171 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database inform… |
CVE-2026-47360 | High | 7.5 | 2026-10-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.
When SessionCookieRemove cha… |
CVE-2026-67106 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information… |
CVE-2026-67104 | Medium | 5.3 | 2026-10-01 | HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessi… |
CVE-2026-96255 | High | 7.5 | 2026-10-01 | The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's… |
CVE-2026-92548 | Medium | 5.3 | 2026-10-01 | The WP Popular Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.4.2 via the 'context' paramet… |
CVE-2026-102121 | High | 8.6 | 2026-09-30 | A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors… |
CVE-2026-47514 | High | 7.8 | 2026-09-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause exposure of kernel stack contents i… |
CVE-2026-13719 | Medium | 4.3 | 2026-09-30 | An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders th… |
CVE-2026-96886 | Medium | 5.3 | 2026-09-30 | The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, em… |
CVE-2026-94274 | Medium | 5.3 | 2026-09-30 | The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still… |
CVE-2026-90953 | Medium | 4.3 | 2026-09-30 | The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticate… |
CVE-2026-86789 | Medium | 5.3 | 2026-09-30 | The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read e… |
CVE-2026-83560 | Medium | 5.3 | 2026-09-30 | The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unc… |
CVE-2026-80333 | Medium | 5.3 | 2026-09-30 | The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticat… |
CVE-2026-102845 | Medium | 5.3 | 2026-09-30 | A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function er… |
CVE-2026-90441 | High | 8.1 | 2026-09-30 | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (includin… |
CVE-2026-76735 | Medium | 4.1 | 2026-09-29 | A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an… |
CVE-2026-95367 | Medium | 5.3 | 2026-09-29 | Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged socia… |
CVE-2026-95336 | Medium | 6.5 | 2026-09-29 | Information leak in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive i… |
CVE-2026-95327 | Medium | 6.5 | 2026-09-29 | Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromi… |
CVE-2026-95312 | Low | 3.1 | 2026-09-29 | Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin… |
CVE-2026-95295 | Medium | 4.6 | 2026-09-29 | Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. (Chrom… |
CVE-2026-102709 | | | 2026-09-29 | Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) entry functions allows an attacker executing in the non-secur… |
CVE-2026-100244 | High | 7.5 | 2026-09-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.
This iss… |
CVE-2026-100241 | High | 7.5 | 2026-09-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.
This issue… |
CVE-2026-100286 | Medium | 6.5 | 2026-09-29 | Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose… |
CVE-2026-22101 | | | 2026-09-29 | The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addre… |
CVE-2026-96869 | Medium | 4.3 | 2026-09-29 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4… |
CVE-2026-100810 | Critical | 9.8 | 2026-09-29 | Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. |
CVE-2026-100766 | Medium | 4.3 | 2026-09-29 | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 15… |
CVE-2026-101265 | Low | 3.1 | 2026-09-29 | A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation… |
CVE-2026-101092 | Medium | 5.3 | 2026-09-28 | SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths fr… |
CVE-2026-102267 | High | 7.4 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated… |
CVE-2026-101146 | Medium | 4.3 | 2026-09-28 | A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom… |
CVE-2026-101143 | Medium | 4.3 | 2026-09-28 | A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown functionality of the file /qm/cz.zoom.scorecard.webui.Scor… |
CVE-2026-101083 | Medium | 5.3 | 2026-09-28 | A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation l… |