CVE-2026-19621 | Medium | 6.5 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before… |
CVE-2026-109401 | Low | 2.7 | 2026-10-16 | The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' p… |
CVE-2026-107646 | Medium | 5.3 | 2026-10-16 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ… |
CVE-2026-109191 | Medium | 4.3 | 2026-10-16 | The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi… |
CVE-2026-78851 | Medium | 6.5 | 2026-10-15 | Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the me… |
CVE-2026-77711 | | | 2026-10-15 | When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mi… |
CVE-2026-76184 | | | 2026-10-15 | In Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/../evil
```
If an attacker is able to control the redirects, then Http… |
CVE-2026-110855 | Medium | 6.5 | 2026-10-14 | GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir… |
CVE-2026-110696 | Medium | 5.3 | 2026-10-14 | A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is an unknown f… |
CVE-2026-64856 | Low | 3.7 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does no… |
CVE-2026-104110 | Medium | 5.3 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php… |
CVE-2026-55682 | High | 8.1 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSES… |
CVE-2026-100406 | | | 2026-10-14 | dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0… |
CVE-2026-54554 | High | 7.5 | 2026-10-14 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint in packages/web/lib/… |
CVE-2026-110777 | Medium | 5.7 | 2026-10-14 | A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64… |
CVE-2026-91157 | High | 7.5 | 2026-10-14 | Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile exist… |
CVE-2026-77572 | Low | 3.3 | 2026-10-14 | VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier, selected metadata IOCTL handlers in the VeraCrypt Windows v… |
CVE-2026-73135 | Medium | 5.3 | 2026-10-14 | Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidd… |
CVE-2026-66853 | Medium | 4.3 | 2026-10-14 | Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction… |
CVE-2026-14851 | | | 2026-10-14 | A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable informati… |
CVE-2026-103380 | Medium | 4.3 | 2026-10-14 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all ve… |
CVE-2026-96904 | Medium | 5.3 | 2026-10-14 | The AWP Classifieds WordPress plugin before 4.4.9 does not verify that a request is authorised to view a listing when a payment transaction is referenced, allo… |
CVE-2026-90989 | Medium | 4.3 | 2026-10-14 | The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subsc… |
CVE-2026-107320 | Medium | 5.3 | 2026-10-14 | The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the… |
CVE-2026-106099 | Medium | 5.3 | 2026-10-14 | The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the… |
CVE-2026-105969 | Medium | 5.3 | 2026-10-14 | The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated user… |
CVE-2026-97471 | Medium | 5.3 | 2026-10-14 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link… |
CVE-2026-110146 | Medium | 6.5 | 2026-10-13 | Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information v… |
CVE-2026-85891 | High | 7.5 | 2026-10-13 | Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. |
CVE-2026-110217 | Medium | 6.5 | 2026-10-13 | Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt passwo… |
CVE-2026-85733 | Medium | 5.3 | 2026-10-13 | FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index… |
CVE-2026-103030 | High | 7.5 | 2026-10-13 | Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original… |
CVE-2026-109526 | Low | 3.3 | 2026-10-13 | A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation l… |
CVE-2026-102981 | Medium | 6.5 | 2026-10-13 | Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invi… |
CVE-2026-77362 | Medium | 4.3 | 2026-10-13 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read acces… |
CVE-2026-74047 | Medium | 6.5 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext auth… |
CVE-2026-109959 | Medium | 4.3 | 2026-10-13 | EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows authenticated users to read audited field values restricted by field-level sec… |
CVE-2026-109958 | Medium | 4.3 | 2026-10-13 | EspoCRM 4.0.0 before 10.0.7 contains an improper access control vulnerability that allows authenticated users to read restricted emailAddress values via the ad… |
CVE-2026-109948 | Medium | 4.3 | 2026-10-13 | FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read… |
CVE-2026-109777 | Medium | 4.3 | 2026-10-13 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 15… |
CVE-2026-109771 | Medium | 4.3 | 2026-10-13 | Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109769 | Medium | 4.3 | 2026-10-13 | Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
CVE-2026-109767 | Medium | 4.3 | 2026-10-13 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109751 | Medium | 4.3 | 2026-10-13 | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109742 | Medium | 4.3 | 2026-10-13 | Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
CVE-2026-109709 | High | 8.8 | 2026-10-13 | Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thu… |
CVE-2026-89097 | Medium | 4.3 | 2026-10-13 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.18 vi… |
CVE-2026-17487 | Medium | 5.3 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process. |
CVE-2026-17484 | Medium | 5.3 | 2026-10-13 | IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control. |
CVE-2026-93892 | High | 8.1 | 2026-10-12 | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tok… |
CVE-2026-82103 | Critical | 9.6 | 2026-10-12 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive informa… |
CVE-2026-75076 | Medium | 4.3 | 2026-10-12 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map fi… |
CVE-2026-108937 | Medium | 5.3 | 2026-10-12 | A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql… |
CVE-2026-108930 | Low | 2.7 | 2026-10-12 | A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the c… |
CVE-2026-102663 | Medium | 4.3 | 2026-10-12 | OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix c… |
CVE-2026-77364 | Medium | 6.5 | 2026-10-12 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all… |
CVE-2026-85966 | High | 7.7 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive informa… |
CVE-2026-109341 | High | 7.1 | 2026-10-12 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by… |
CVE-2026-109335 | Medium | 6.5 | 2026-10-12 | SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permiss… |
CVE-2026-109325 | High | 7.5 | 2026-10-12 | Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticate… |
CVE-2026-109315 | Medium | 6.5 | 2026-10-12 | Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token because the sandbo… |
CVE-2026-109314 | High | 7.3 | 2026-10-12 | Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a pag… |
CVE-2026-109304 | Medium | 4.9 | 2026-10-12 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blocklist does not cover D… |
CVE-2026-109293 | Medium | 6.5 | 2026-10-12 | Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to… |
CVE-2026-109292 | Medium | 6.8 | 2026-10-12 | Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receivi… |
CVE-2026-109259 | Medium | 5.3 | 2026-10-12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an uninitialized memory read in the TGA image decoder that can expose memory contents. Attackers… |
CVE-2026-108811 | Medium | 4.3 | 2026-10-12 | A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/… |
CVE-2026-108810 | Medium | 5.3 | 2026-10-12 | A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The ma… |
CVE-2026-108861 | Medium | 4.3 | 2026-10-11 | Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_met… |
CVE-2026-108578 | Medium | 5.3 | 2026-10-11 | A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such m… |
CVE-2026-97183 | Medium | 4.3 | 2026-10-11 | The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a S… |
CVE-2026-88785 | Medium | 4.7 | 2026-10-11 | The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an op… |
CVE-2026-107694 | Low | 2.7 | 2026-10-11 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is r… |
CVE-2026-104681 | Low | 2.7 | 2026-10-11 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permi… |
CVE-2026-18496 | Medium | 5.3 | 2026-10-10 | The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.4.3 via the wpbc_is_show_pop… |
CVE-2026-105995 | Medium | 5.3 | 2026-10-10 | The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated use… |
CVE-2026-105990 | Medium | 5.3 | 2026-10-10 | The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submission… |
CVE-2026-103964 | Medium | 4.3 | 2026-10-10 | The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first_name' par… |
CVE-2026-103365 | Medium | 5.3 | 2026-10-10 | The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and inclu… |
CVE-2026-107842 | Medium | 5.3 | 2026-10-09 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets t… |
CVE-2026-107811 | High | 8.8 | 2026-10-09 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose… |
CVE-2026-78795 | High | 7.5 | 2026-10-09 | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive in… |
CVE-2026-92990 | Medium | 5.3 | 2026-10-09 | The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a pe… |
CVE-2026-83943 | High | 8.7 | 2026-10-08 | Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network. |
CVE-2026-107715 | Medium | 6.8 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host… |
CVE-2026-107714 | Medium | 5.9 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-orig… |
CVE-2026-107399 | Medium | 6.8 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#r… |
CVE-2026-84274 | Medium | 6.5 | 2026-10-08 | IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive cre… |
CVE-2026-107383 | High | 7.5 | 2026-10-08 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the Geo… |
CVE-2026-105452 | | | 2026-10-08 | Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials o… |
CVE-2026-107604 | Medium | 4.9 | 2026-10-08 | A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only th… |
CVE-2026-87426 | Medium | 4.3 | 2026-10-08 | An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration… |
CVE-2026-94275 | Medium | 5.3 | 2026-10-08 | The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenti… |
CVE-2026-94258 | Low | 2.7 | 2026-10-08 | The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored… |
CVE-2026-94244 | Medium | 4.3 | 2026-10-08 | The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain… |
CVE-2026-86826 | Medium | 5.9 | 2026-10-08 | The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthentic… |
CVE-2026-105195 | Low | 2.7 | 2026-10-08 | The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings han… |
CVE-2026-105194 | Medium | 4.3 | 2026-10-08 | The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level acce… |
CVE-2026-106561 | Medium | 5.0 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive infor… |
CVE-2026-88514 | Medium | 5.5 | 2026-10-07 | An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information. |