CVE-2026-94053 | Critical | 9.1 | 2026-09-30 | Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5.
Apache MINA SSHD is… |
CVE-2026-94052 | Critical | 9.1 | 2026-09-30 | A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authenticatio… |
CVE-2026-77185 | Critical | 9.1 | 2026-09-30 | Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to implement an SSH… |
CVE-2026-102458 | Critical | 9.8 | 2026-09-30 | EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords thr… |
CVE-2026-102455 | Critical | 9.8 | 2026-09-30 | EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by s… |
CVE-2026-97196 | Critical | 9.1 | 2026-09-30 | Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass.
This issue affects GiveWP: fro… |
CVE-2026-103110 | Critical | 9.8 | 2026-09-30 | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unp… |
CVE-2026-102911 | Critical | 9.9 | 2026-09-30 | A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP to… |
CVE-2026-103056 | Critical | 9.0 | 2026-09-30 | AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings… |
CVE-2026-102794 | Critical | 9.1 | 2026-09-30 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of… |
CVE-2026-102793 | Critical | 9.1 | 2026-09-30 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This mani… |
CVE-2026-103041 | Critical | 9.8 | 2026-09-29 | LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can… |
CVE-2026-103040 | Critical | 9.8 | 2026-09-29 | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling flag. The service exp… |
CVE-2026-102792 | Critical | 9.1 | 2026-09-29 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the… |
CVE-2026-72510 | Critical | 9.0 | 2026-09-29 | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. |
CVE-2026-72507 | Critical | 9.0 | 2026-09-29 | The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulner… |
CVE-2026-71379 | Critical | 10.0 | 2026-09-29 | The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. |
CVE-2026-70356 | Critical | 9.1 | 2026-09-29 | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web ser… |
CVE-2026-68954 | Critical | 9.0 | 2026-09-29 | The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. |
CVE-2026-68068 | Critical | 9.0 | 2026-09-29 | The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL inj… |
CVE-2026-63713 | Critical | 9.0 | 2026-09-29 | The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability. |
CVE-2026-96587 | Critical | 10.0 | 2026-09-29 | The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critic… |
CVE-2026-79538 | Critical | 9.8 | 2026-09-29 | metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (create… |
CVE-2026-76725 | Critical | 9.6 | 2026-09-29 | A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumve… |
CVE-2026-76724 | Critical | 9.6 | 2026-09-29 | A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform… |
CVE-2026-76723 | Critical | 9.6 | 2026-09-29 | Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achie… |
CVE-2026-76722 | Critical | 9.8 | 2026-09-29 | Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker… |
CVE-2026-76721 | Critical | 9.8 | 2026-09-29 | Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrar… |
CVE-2026-53988 | Critical | 10.0 | 2026-09-29 | Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arb… |
CVE-2026-39117 | Critical | 9.8 | 2026-09-29 | An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index… |
CVE-2026-102331 | Critical | 9.6 | 2026-09-29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sand… |
CVE-2026-102316 | Critical | 9.6 | 2026-09-29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-102309 | Critical | 9.6 | 2026-09-29 | Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-102308 | Critical | 9.6 | 2026-09-29 | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the s… |
CVE-2026-102306 | Critical | 9.6 | 2026-09-29 | Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a c… |
CVE-2026-102304 | Critical | 9.6 | 2026-09-29 | Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML… |
CVE-2026-100291 | Critical | 9.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This… |
CVE-2026-95357 | Critical | 9.6 | 2026-09-29 | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sa… |
CVE-2026-95356 | Critical | 9.6 | 2026-09-29 | Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary… |
CVE-2026-95350 | Critical | 9.6 | 2026-09-29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-95349 | Critical | 9.6 | 2026-09-29 | Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sand… |
CVE-2026-95347 | Critical | 9.6 | 2026-09-29 | Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted… |
CVE-2026-95339 | Critical | 9.6 | 2026-09-29 | Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted H… |
CVE-2026-95331 | Critical | 9.6 | 2026-09-29 | Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-95329 | Critical | 9.6 | 2026-09-29 | Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-95325 | Critical | 9.6 | 2026-09-29 | Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
CVE-2026-95318 | Critical | 9.6 | 2026-09-29 | Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craf… |
CVE-2026-95313 | Critical | 9.6 | 2026-09-29 | Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-95311 | Critical | 9.6 | 2026-09-29 | Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitra… |
CVE-2026-95310 | Critical | 9.6 | 2026-09-29 | Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML p… |
CVE-2026-95299 | Critical | 9.6 | 2026-09-29 | Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page… |
CVE-2026-95283 | Critical | 9.6 | 2026-09-29 | Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandb… |
CVE-2026-95281 | Critical | 9.6 | 2026-09-29 | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-95277 | Critical | 9.6 | 2026-09-29 | Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a craft… |
CVE-2026-84436 | Critical | 9.1 | 2026-09-29 | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user… |
CVE-2026-77177 | Critical | 9.8 | 2026-09-29 | Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with… |
CVE-2023-54400 | Critical | 9.8 | 2026-09-29 | Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary S… |
CVE-2026-82973 | Critical | 9.4 | 2026-09-29 | Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when be… |
CVE-2026-100819 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42… |
CVE-2026-100818 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. |
CVE-2026-100811 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17. |
CVE-2026-100804 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157. |
CVE-2026-100800 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157. |
CVE-2026-100786 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox… |
CVE-2026-100778 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and… |
CVE-2026-100770 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.4… |
CVE-2026-100762 | Critical | 9.6 | 2026-09-29 | Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.4… |
CVE-2026-8066 | Critical | 9.1 | 2026-09-29 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write… |
CVE-2026-8065 | Critical | 9.1 | 2026-09-29 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to uplo… |
CVE-2026-84154 | Critical | 9.9 | 2026-09-29 | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an att… |
CVE-2026-102240 | Critical | 10.0 | 2026-09-29 | A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network T… |
CVE-2026-101354 | Critical | 9.6 | 2026-09-29 | A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Perfo… |
CVE-2026-102361 | Critical | 9.1 | 2026-09-29 | mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any store… |
CVE-2026-101264 | Critical | 9.1 | 2026-09-29 | A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the a… |
CVE-2026-101263 | Critical | 9.1 | 2026-09-29 | A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation… |
CVE-2026-101262 | Critical | 9.1 | 2026-09-28 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulatio… |
CVE-2026-101261 | Critical | 9.1 | 2026-09-28 | A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the a… |
CVE-2026-101260 | Critical | 9.1 | 2026-09-28 | A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Perform… |
CVE-2026-102268 | Critical | 9.1 | 2026-09-28 | PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recogni… |
CVE-2026-101187 | Critical | 9.1 | 2026-09-28 | A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/ap… |
CVE-2026-49994 | Critical | 9.1 | 2026-09-28 | Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validati… |
CVE-2026-101894 | Critical | 9.1 | 2026-09-28 | The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment check… |
CVE-2026-101081 | Critical | 9.1 | 2026-09-28 | A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the com… |
CVE-2026-88804 | Critical | 9.6 | 2026-09-28 | An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Ra… |
CVE-2026-12342 | Critical | 9.6 | 2026-09-28 | This vulnerability
impacts all versions of IdentityIQ and allows an unauthenticated user remote
code execution on the IdentityIQ server due to improper input v… |
CVE-2026-101077 | Critical | 10.0 | 2026-09-28 | A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missi… |
CVE-2026-101076 | Critical | 10.0 | 2026-09-28 | A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. Th… |
CVE-2026-101075 | Critical | 10.0 | 2026-09-28 | A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the comp… |
CVE-2026-101074 | Critical | 9.8 | 2026-09-28 | A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authenti… |
CVE-2026-90924 | Critical | 9.8 | 2026-09-28 | Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usern… |
CVE-2026-87799 | Critical | 9.9 | 2026-09-28 | Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an au… |
CVE-2026-85526 | Critical | 9.9 | 2026-09-28 | Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or… |
CVE-2026-85185 | Critical | 9.6 | 2026-09-28 | Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticate… |
CVE-2026-101072 | Critical | 10.0 | 2026-09-28 | A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such m… |
CVE-2026-101039 | Critical | 10.0 | 2026-09-28 | A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. S… |
CVE-2026-101038 | Critical | 9.9 | 2026-09-28 | A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Par… |
CVE-2026-101037 | Critical | 9.9 | 2026-09-28 | A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The man… |
CVE-2026-82384 | Critical | 9.8 | 2026-09-28 | Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, becau… |
CVE-2026-82378 | Critical | 9.0 | 2026-09-28 | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding req… |
CVE-2026-82377 | Critical | 9.9 | 2026-09-28 | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the lega… |