CVE-2026-108857 | Low | 3.3 | 2026-10-11 | Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args s… |
CVE-2026-108851 | Low | 3.3 | 2026-10-11 | phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs becaus… |
CVE-2026-108754 | Low | 3.3 | 2026-10-11 | GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query strin… |
CVE-2026-108749 | Low | 3.7 | 2026-10-11 | docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/me… |
CVE-2026-108745 | Low | 3.1 | 2026-10-11 | CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB ex… |
CVE-2026-108741 | Low | 3.1 | 2026-10-11 | Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a… |
CVE-2026-108736 | Low | 3.7 | 2026-10-11 | Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus… |
CVE-2026-108723 | Low | 2.5 | 2026-10-11 | answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text with… |
CVE-2026-108566 | Low | 3.5 | 2026-10-11 | A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/inde… |
CVE-2026-107694 | Low | 2.7 | 2026-10-11 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is r… |
CVE-2026-107507 | Low | 2.7 | 2026-10-11 | The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the lowest-tier Trainer r… |
CVE-2026-104684 | Low | 2.7 | 2026-10-11 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed a… |
CVE-2026-104682 | Low | 2.7 | 2026-10-11 | The Envira Gallery WordPress plugin before 1.16.2 does not correctly check authorization on its gallery-conversion feature, verifying that the requester can e… |
CVE-2026-104681 | Low | 2.7 | 2026-10-11 | The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permi… |
CVE-2026-108603 | Low | 3.3 | 2026-10-10 | slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output di… |
CVE-2026-108594 | Low | 3.5 | 2026-10-10 | Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the i… |
CVE-2026-108505 | Low | 3.3 | 2026-10-10 | ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-relate… |
CVE-2026-108503 | Low | 3.3 | 2026-10-10 | ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker c… |
CVE-2026-108502 | Low | 3.3 | 2026-10-10 | ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs. |
CVE-2026-104006 | Low | 3.7 | 2026-10-10 | The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1… |
CVE-2026-105977 | Low | 2.2 | 2026-10-10 | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users wit… |
CVE-2026-104754 | Low | 3.5 | 2026-10-10 | The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allow… |
CVE-2026-104742 | Low | 3.1 | 2026-10-10 | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2… |
CVE-2026-104741 | Low | 3.1 | 2026-10-10 | The AI Puffer – Chat. Create. Automate. (formerly AI Power) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2… |
CVE-2026-107848 | Low | 3.5 | 2026-10-09 | Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declar… |
CVE-2026-96395 | Low | 3.6 | 2026-10-09 | The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previ… |
CVE-2026-96394 | Low | 2.9 | 2026-10-09 | The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when gener… |
CVE-2026-96393 | Low | 3.6 | 2026-10-09 | The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-… |
CVE-2026-101130 | Low | 3.6 | 2026-10-09 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity docum… |
CVE-2026-101094 | Low | 3.6 | 2026-10-09 | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affini… |
CVE-2026-78021 | Low | 3.7 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnera… |
CVE-2026-78017 | Low | 3.8 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability… |
CVE-2026-78016 | Low | 3.1 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low… |
CVE-2026-78015 | Low | 3.7 | 2026-10-09 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attack… |
CVE-2026-106095 | Low | 3.3 | 2026-10-09 | The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of… |
CVE-2026-87108 | Low | 3.1 | 2026-10-09 | An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they posse… |
CVE-2026-107890 | Low | 3.3 | 2026-10-09 | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed sep… |
CVE-2026-107886 | Low | 2.3 | 2026-10-09 | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_clas… |
CVE-2026-107885 | Low | 3.3 | 2026-10-09 | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses… |
CVE-2026-107727 | Low | 3.7 | 2026-10-08 | Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/p… |
CVE-2026-87980 | Low | 3.1 | 2026-10-08 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive informatio… |
CVE-2026-12091 | Low | 3.7 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-… |
CVE-2026-11939 | Low | 2.7 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery. |
CVE-2026-106432 | Low | 3.6 | 2026-10-08 | The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4… |
CVE-2026-106428 | Low | 3.7 | 2026-10-08 | An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed… |
CVE-2026-107296 | Low | 3.7 | 2026-10-08 | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes… |
CVE-2026-107676 | Low | 3.3 | 2026-10-08 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitiali… |
CVE-2026-107288 | Low | 3.7 | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_t… |
CVE-2026-89290 | Low | 3.5 | 2026-10-08 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzami… |
CVE-2026-107570 | Low | 2.5 | 2026-10-08 | heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template. |
CVE-2026-94258 | Low | 2.7 | 2026-10-08 | The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored… |
CVE-2026-105197 | Low | 2.7 | 2026-10-08 | The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted fo… |
CVE-2026-105196 | Low | 3.3 | 2026-10-08 | The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an… |
CVE-2026-105195 | Low | 2.7 | 2026-10-08 | The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings han… |
CVE-2026-104645 | Low | 2.7 | 2026-10-08 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management a… |
CVE-2026-107449 | Low | 3.4 | 2026-10-08 | linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats re… |
CVE-2026-107448 | Low | 3.4 | 2026-10-08 | Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen… |
CVE-2026-92862 | Low | 3.3 | 2026-10-08 | The Android application "Ticket Ryutsu Center" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website… |
CVE-2026-87726 | Low | 3.9 | 2026-10-08 | Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party… |
CVE-2026-107284 | Low | 3.7 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-107283 | Low | 3.7 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-107269 | Low | 3.7 | 2026-10-07 | Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by m… |
CVE-2026-107170 | Low | 2.9 | 2026-10-07 | A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditio… |
CVE-2026-104678 | Low | 2.7 | 2026-10-07 | The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level… |
CVE-2026-106583 | Low | 2.5 | 2026-10-07 | In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection. |
CVE-2026-106589 | Low | 2.9 | 2026-10-06 | In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is relate… |
CVE-2026-106588 | Low | 3.1 | 2026-10-06 | In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side effect of loss of sandboxing, which is potentially unexpected. |
CVE-2026-106587 | Low | 3.6 | 2026-10-06 | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean that a feature is d… |
CVE-2026-106496 | Low | 3.1 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by inconsistent enforc… |
CVE-2026-106586 | Low | 2.5 | 2026-10-06 | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different vulnerabi… |
CVE-2026-106584 | Low | 2.5 | 2026-10-06 | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can be a slightly more s… |
CVE-2026-106582 | Low | 3.7 | 2026-10-06 | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Crossing the Streams"… |
CVE-2026-106555 | Low | 2.2 | 2026-10-06 | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. |
CVE-2026-106553 | Low | 2.2 | 2026-10-06 | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. |
CVE-2026-106493 | Low | 3.0 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A p… |
CVE-2026-106487 | Low | 3.5 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported ca… |
CVE-2026-106449 | Low | 3.7 | 2026-10-06 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles e… |
CVE-2026-102164 | Low | 3.1 | 2026-10-06 | On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client assoc… |
CVE-2026-106399 | Low | 3.3 | 2026-10-06 | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially read memory via a craf… |
CVE-2026-106339 | Low | 3.1 | 2026-10-06 | Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially obta… |
CVE-2026-106224 | Low | 3.1 | 2026-10-06 | Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross… |
CVE-2026-106210 | Low | 3.1 | 2026-10-06 | Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension… |
CVE-2026-106180 | Low | 3.1 | 2026-10-06 | Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTM… |
CVE-2026-106101 | Low | 3.1 | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.32.2, the openURL() utility in ui/src/utils/open-url/open-url… |
CVE-2026-105950 | Low | 3.5 | 2026-10-06 | A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribute of the file formw… |
CVE-2026-105800 | Low | 3.7 | 2026-10-06 | i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled langua… |
CVE-2026-105795 | Low | 3.1 | 2026-10-06 | Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card_path from an attac… |
CVE-2026-106026 | Low | 3.7 | 2026-10-06 | tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Un… |
CVE-2026-56596 | Low | 3.5 | 2026-10-06 | HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data… |
CVE-2026-105808 | Low | 3.5 | 2026-10-06 | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults… |
CVE-2026-105611 | Low | 2.7 | 2026-10-06 | A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/or… |
CVE-2026-105752 | Low | 3.1 | 2026-10-05 | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests… |
CVE-2026-105746 | Low | 2.2 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the K… |
CVE-2026-105742 | Low | 3.7 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the H… |
CVE-2026-105767 | Low | 3.3 | 2026-10-05 | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Academy (edu) from commi… |
CVE-2026-105766 | Low | 3.1 | 2026-10-05 | Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e… |
CVE-2026-105683 | Low | 3.8 | 2026-10-05 | Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside th… |
CVE-2026-105682 | Low | 2.7 | 2026-10-05 | Ghost is a Node.js content management system. From 1.18.0 until 6.27.0, an SSRF vulnerability in the webhooks feature allowed staff users to probe internal hos… |
CVE-2026-105652 | Low | 3.1 | 2026-10-05 | Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' h… |
CVE-2026-104029 | Low | 3.3 | 2026-10-05 | A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to im… |