CVEs published October 7, 2026
330 CVEs were published on October 7, 2026: 51 critical, 119 high. Browse them by severity, product and exploitation status.
- Published
- 330
- Critical
- 51
- High
- 119
- Medium
- 151
- Low
- 8
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 181
Most affected products
- ImageMagick
- 20
- Splunk Enterprise
- 19
- IBM Langflow OSS
- 13
- qax-os excelize · github.com/xuri/excelize/v2
- 11
- Red Hat Enterprise Linux
- 9
- AsyncHttpClient async-http-client · org.asynchttpclient:asy…
- 8
- Cisco License On-Prem
- 8
- Cisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- 7
- Cisco NX-OS Software
- 6
- Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- 6
Critical 51
- CVE-2026-107282AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-76285Improper Adherence to Coding Standards in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76284Improper Neutralization in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76268Missing Authentication for Critical Function in the Patroni REST API in Splunk EnterpriseSplunk Enterprise
- CVE-2026-95606WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerabilityLiquid Web / StellarWP The Events Calendar
- CVE-2026-95605WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerabilityPassionate Programmer Peter WP Data Access
- CVE-2026-76464Cisco Meraki Hardening Release October 2026 - Buffer Management VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76501Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution VulnerabilityCisco NX-OS Software
- CVE-2026-76500Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime…Cisco Application Policy Infrastructure Controller
- CVE-2026-76498Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control VulnerabilitiesCisco Application Policy Infrastructure Controller
- CVE-2026-76499Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization VulnerabilitiesCisco Application Policy Infrastructure Controller
- CVE-2026-76486Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution VulnerabilityCisco NX-OS Software
- CVE-2026-76485Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution VulnerabilityCisco NX-OS Software
- CVE-2026-76483Cisco License On-Prem Security Hardening ReleaseCisco License On-Prem
- CVE-2026-76482Cisco License On-Prem Security Hardening ReleaseCisco License On-Prem
- CVE-2026-76480Cisco License On-Prem Security Hardening ReleaseCisco License On-Prem
- CVE-2026-76459Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-76471Cisco NX-OS Software NX-API Remote Code Execution VulnerabilityCisco NX-OS Software · Cisco Unified Computing System
- CVE-2026-76455Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-76465Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution VulnerabilityCisco NX-OS Software
- CVE-2026-62252Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Loginsipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-76454Cisco Smart Software Manager On-Prem Unauthenticated API VulnerabilityCisco License On-Prem
- CVE-2026-20328Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset VulnerabilityCisco License On-Prem
- CVE-2026-62253Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)sipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-62176PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationMervinPraison PraisonAI · praisonai
Show all 51 entriesShow fewer entries
- CVE-2026-92414Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokensApache Software Foundation org.apache.jackrabbit:jackrabbit…
- CVE-2026-107204LMCache through 0.5.5 Unauthenticated RCE via /run_script EndpointLMCache
- CVE-2026-107202CVE-2026-107202jonssonyan h-ui
- CVE-2026-107194Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentiallySungrow iSolarCloud
- CVE-2026-107183llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parserggml-org llama.cpp
- CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.SonicWall SMA1000
- CVE-2026-96408A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitSix Apart Movable Type Cloud Edition · Six Apart Movable Ty…
- CVE-2026-105192LMCache Unauthenticated RCE in multiprocess mode via pickle deserializationLMCache
- CVE-2026-103416Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message Eclipse Foundation Eclipse ThreadX - NetX Duo
- CVE-2025-64393This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.Veeam Backup and Replication
- CVE-2026-97720Apache Impala: Impala Executor Webserver Auth BypassApache Software Foundation Apache Impala
- CVE-2026-107104Unsafe Deserialization Vulnerability in Manacle Technologies ERP SystemManacle Technologies Multi-tenant ERP System
- CVE-2026-107103SQL Injection Vulnerability in Manacle Technologies ERP SystemManacle Technologies Multi-tenant ERP System
- CVE-2026-107102Account Takeover Vulnerability in Manacle Technologies ERP SystemManacle Technologies Multi-tenant ERP System
- CVE-2026-102782Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0ordasoft.com OrdaSoft Simple Membership extension for Joomla
- CVE-2026-59346VMware Workstation and Fusion VMXNET3 integer-overflow vulnerabilityVMware Workstation · VMware Fusion
- CVE-2026-19572FlexNet Publisher lmadmin SOAP Authentication Bypass VulnerabilityFlexera FlexNet Publisher
- CVE-2026-16516wolfSSH ECDSA host key curve not validated against negotiated algorithmwolfSSL wolfSSH
- CVE-2026-14911Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to readASUS Router
- CVE-2026-19386A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuASUS Router
- CVE-2026-105324An HTTP header injection vulnerability was found in the ADMASUSTOR ADM
- CVE-2026-93674Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2025-70516The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless user
- CVE-2025-70518The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.
- CVE-2025-70520The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless user
- CVE-2025-70521The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.
High 119
- CVE-2026-89322Vault ACL Policy Evaluation May Allow Bypass of Deny RestrictionsHashiCorp Vault · vault
- CVE-2026-105816Vault Vulnerable to Arbitrary Code Execution via Plugin Catalog Entries Restored From Raft SnapshotsHashiCorp Vault · vault
- CVE-2026-107281AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identitiesAsyncHttpClient async-http-client
- CVE-2026-107279AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-intAsyncHttpClient async-http-client
- CVE-2026-107232AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECTAsyncHttpClient async-http-client
- CVE-2026-107231AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-107230AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-107227AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-76283Protection Mechanism Failure in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76282Improper Control of a Resource Through its Lifetime in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76266Local Privilege Escalation through Linux Package Upgrades in Splunk EnterpriseSplunk Enterprise
- CVE-2026-107352Missing authorization checks in Amazon Athena engine version 3 request handlingAWS Amazon Athena
- CVE-2026-97716Denial of Service in Absolute Secure AccessAbsolute Security Secure Access
- CVE-2026-34499Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.Johnson Controls ADVMS
- CVE-2026-97715Denial of Service in Absolute Secure AccessAbsolute Security Secure Access
- CVE-2026-107161Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clientsRed Hat Enterprise Linux · Red Hat Hardened Images +2
- CVE-2026-97714Denial of service vulnerability in Secure AccessAbsolute Security Secure Access
- CVE-2026-107223Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-103371Apache Geode: Management REST API: Insertion of Sensitive Information into Log FileApache Software Foundation Apache Geode
- CVE-2026-107219Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107217Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-106164Infinite Loop in Telerik Document Processing XLS ImportProgress Software Telerik Document Processing Libraries
- CVE-2026-107216Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107215Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-56851Panic parsing crafted input in x/text/secure/precis in golang.org/x/textgolang.org/x/text/secure/precis · golang.org/x/text
Show all 119 entriesShow fewer entries
- CVE-2026-107214Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-107213Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107212Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysqax-os excelize · github.com/xuri/excelize/v2 +1
- CVE-2026-107211Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-96335WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerabilityWPMU DEV Forminator
- CVE-2026-95595WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerabilityFontsplugin Disable and Remove Google Fonts | GDPR & DSGVO…
- CVE-2026-95534WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerabilityUnlimited Elements For Elementor
- CVE-2026-94670WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerabilityEverest Forms
- CVE-2026-94662WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilityUnlimited Elements For Elementor
- CVE-2026-92543Docker Engine insecure-registry fallback via malicious DNS responsesDocker Engine · Moby
- CVE-2026-106557Backstage: Improper input validation in TechDocs Markdown extension configurationbackstage · @backstage plugin-techdocs-node +1
- CVE-2026-76472Cisco Meraki Security Hardening Release October 2026 - Improper Neutralization of Special Elements VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76467Cisco Meraki Software Hardening Release - Resource Lifetime Management VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76470Cisco Meraki Hardening Release - Incorrect Calculation VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76469Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76468Cisco Meraki Hardening Release - Input Validation VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76463Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control VulnerabilitiesCisco Campus Gateway Software · Cisco Meraki MR Wireless… +2
- CVE-2026-76484Cisco License On-Prem Security Hardening ReleaseCisco License On-Prem
- CVE-2026-76458Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Handling of Exceptional Conditions VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-76457Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Read VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-76456Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Input Validation VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-76453Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Neutralization VulnerabilitiesCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2026-20362Cisco Finesse Server-Side Request Forgery VulnerabilityCisco Finesse
- CVE-2026-62251Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/querysipcapture homer · github.com/sipcapture/homer-app
- CVE-2026-107270Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpointsgophish
- CVE-2026-107206LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management APILMCache
- CVE-2026-107205LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control APILMCache
- CVE-2026-106560Backstage: Improper repository path validation in a Scaffolder backend modulebackstage · @backstage plugin-scaffolder-backend-module-… +1
- CVE-2026-106558Backstage: Improper validation of TechDocs MkDocs configurationbackstage · @backstage plugin-techdocs-node +1
- CVE-2026-106556Backstage: Configuration bypass in TechDocs mkdocs.yml sanitizationbackstage · @backstage plugin-techdocs-node
- CVE-2026-106510Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.ymlbackstage · @backstage plugin-techdocs-node +1
- CVE-2026-77214libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBufferlibexpat
- CVE-2026-46434wger: Trainer Privilege Escalation - Improper Privilege Managementwger-project wger · wger
- CVE-2026-107181Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: SchemeTelegram Desktop
- CVE-2026-43976wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)wger-project wger · wger
- CVE-2026-102257A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the SonicWall SMA1000
- CVE-2026-102256Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identiSonicWall SMA1000
- CVE-2026-98374tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()Linux
- CVE-2026-103435Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code@anthropic-ai/claude-code
- CVE-2026-107180MISP: Forced TOTP Enrolment Bypassed via Non-Browser Request Types on otp_required InstancesMISP
- CVE-2026-107177Express Gateway through 1.16.11 Hardcoded Default cipherKey Exposes OAuth TokensExpressGateway express-gateway
- CVE-2026-107162Express Gateway through 1.16.11 OAuth 2.0 Refresh Token Validation BypassExpressGateway express-gateway
- CVE-2026-105138Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry APIobot-platform obot
- CVE-2026-107159MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Headerminiupnp project miniupnpd
- CVE-2026-106059GitAhead through 2.7.1 on macOS Command Injection via Show in Finder AppleScriptgitahead
- CVE-2026-106058GitAhead through 2.7.1 OS Command Injection via Git Filter Filenamesgitahead
- CVE-2026-106057patool before 4.0.6 OS Command Injection on Windows via shell_quote_ntwummel patool
- CVE-2026-106056Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quotingrundeck
- CVE-2026-42708WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerabilityAF themes WP Post Author
- CVE-2026-42710WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerabilitySlider by 10Web
- CVE-2026-42713WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerabilityGopiplus Post title marquee scroll
- CVE-2026-42714WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerabilityPiggly Dev Pix por Piggly
- CVE-2026-92533Path Traversal in BugTracker.NETBugTracker.NET
- CVE-2026-92532Unrestricted Upload of File with Dangerous Type in BugTracker.NETBugTracker.NET
- CVE-2026-92531Improper Neutralization of Special Elements used in an OS Command in BugTracker.NETBugTracker.NET
- CVE-2026-103668An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute anSix Apart Movable Type Cloud Edition · Six Apart Movable Ty…
- CVE-2026-42720WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerabilitySarah Giles Dynamic User Directory
- CVE-2026-42721WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerabilitySERVIT Software Solutions affiliate-toolkit
- CVE-2026-15894Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisementzephyrproject zephyr
- CVE-2026-19186Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and writezephyrproject zephyr
- CVE-2026-58069This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provideVeeam Backup and Replication
- CVE-2026-5703Path Traversal in Satel Iberia SenNet Datalogger Serie 200Satel Iberia SenNet Datalogger Serie
- CVE-2026-89417OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feeddaanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google…
- CVE-2026-82212Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Bypass via NPG Notification HandlerNexi XPay Build
- CVE-2026-82211Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key DisclosureNexi XPay Build
- CVE-2026-97188String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database EditorString locator
- CVE-2026-87971If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' ParameterIf-So Dynamic Content
- CVE-2026-87782Koinonia Link 1.1.2 - 1.1.4 - Subscriber+ Privilege Escalation to AdministratorKoinonia Link
- CVE-2026-105316Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode ActionsMagee Shortcodes
- CVE-2026-104677WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHPWP Coder
- CVE-2026-59347VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerabilityVMware Workstation · VMware Fusion
- CVE-2026-102173Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadatathemeum Kirki – Freeform Page Builder, Website Builder & Cu…
- CVE-2026-83540wolfSSHd on Windows race condition leading to logon token reused across connectionswolfSSL wolfSSH
- CVE-2026-19396A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an uASUS Router
- CVE-2026-16528Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentASUS Router
- CVE-2026-106471Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latchingRed Hat Satellite
- CVE-2026-102478In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing accessOctopus Deploy Octopus Server
- CVE-2026-88962Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93443Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93449Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93445Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93447Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93675Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93677Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93678Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-97673Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2025-70517The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing r
- CVE-2025-70522The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing r
- CVE-2026-42616In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfsca
- CVE-2026-42617In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in th
- CVE-2026-42618In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of
- CVE-2026-46569In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt
- CVE-2026-46570In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an attacker to corrupt
- CVE-2026-46572In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt hea
Medium, low and unrated 160
- CVE-2026-17538Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII ModificationAppointment Booking Plugin – LatePoint | Calendar & Schedul…
- CVE-2026-94154Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameterr3098 Aurora Heatmap
- CVE-2026-107315pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)pgjdbc
- CVE-2026-107314pgjdbc does not enforce requireAuth when the value excludes every authentication methodpgjdbc
- CVE-2026-105820Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy ResolutionHashiCorp Vault Enterprise
- CVE-2026-107285AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-107284AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept checkAsyncHttpClient async-http-client
- CVE-2026-107283AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-105818Vault PKI ACME Issues Certificate With Unvalidated SANsHashiCorp Vault · vault
- CVE-2026-107280AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukAsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-107229AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hostsAsyncHttpClient async-http-client
- CVE-2026-107228AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)AsyncHttpClient async-http-client · org.asynchttpclient:asy…
- CVE-2026-76286Server-Side Request Forgery (SSRF) through Custom API Tools in Splunk MCP ServerSplunk MCP Server
- CVE-2026-76281Improper Access Control in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76280Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure GatewaySplunk Enterprise · Splunk Secure Gateway
- CVE-2026-76279Improper Input Validation of Index Names through the collect Command in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76278Authorization Bypass in SPL2 Module Permissions in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76277Improper Input Validation of Native Splunk Usernames through the REST API in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76276Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk EnterpriseSplunk Enterprise
- CVE-2026-76275Improper Authorization in Search Job Listings through the REST API in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76274Server-Side Request Forgery (SSRF) through the REST API in Splunk App for Splunk Observability CloudSplunk Enterprise
- CVE-2026-76273Improper Input Validation through the collect Command in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76272Missing Access Control through the REST API in Splunk Secure GatewaySplunk Enterprise · Splunk Secure Gateway
- CVE-2026-76271Denial of Service (DoS) in the Discover Splunk Observability Cloud app for Splunk EnterpriseSplunk Enterprise
- CVE-2026-76270Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk EnterpriseSplunk Enterprise
Show all 160 entriesShow fewer entries
- CVE-2026-76269Improper Access Control in Search Job Retrieval through the REST API in Splunk EnterpriseSplunk Enterprise
- CVE-2026-76267Log Injection through the REST API in Splunk App for Splunk O11y CloudSplunk Enterprise
- CVE-2026-76265Improper Access Control through REST API Endpoints in Splunk Secure GatewaySplunk Enterprise · Splunk Secure Gateway
- CVE-2026-76264Improper Authorization through the REST API in Splunk EnterpriseSplunk Enterprise
- CVE-2026-107363In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authentOpenStack Zaqar
- CVE-2026-1403Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2026-97717Denial of Service in Absolute Secure AccessAbsolute Security Secure Access
- CVE-2026-107353traverse: set() can write to built-in prototypes via an untrusted pathljharb traverse
- CVE-2026-107176Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secretRed Hat OpenShift Container Platform
- CVE-2026-107225Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107224Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107222Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107221Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107220Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107218Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsqax-os excelize · github.com/xuri/excelize/v2
- CVE-2026-107313pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connectionspgjdbc
- CVE-2026-106067Gimp: gimp: heap buffer overflow in hot color filter on oversized imageRed Hat Enterprise Linux
- CVE-2026-106066Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensionsRed Hat Enterprise Linux
- CVE-2026-106065Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensionsRed Hat Enterprise Linux
- CVE-2026-92542Blind VXLAN injection into encrypted overlay networks from cluster peerDocker Engine · Moby overlay network driver
- CVE-2026-76488Cisco Application Policy Infrastructure Controller Authenticated Information Disclosure VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2026-101886Cisco Jabber for Android Path Traversal via Shared Content URICisco Jabber for Android
- CVE-2026-76437Cisco Smart Software Manager On-Prem Command Injection VulnerabilityCisco License On-Prem
- CVE-2026-76452Cisco Smart Software Manager On-Prem SQL Injection VulnerabilityCisco License On-Prem
- CVE-2026-20173Cisco NX-OS Software Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2026-20032Cisco NX-OS Software Python Sandbox Escape VulnerabilityCisco NX-OS Software
- CVE-2026-20038Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2026-20321Cisco Application Policy Infrastructure Controller API Command Injection VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2026-107166Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resourcesOpen5GS
- CVE-2026-107210ImageMagick: Policy Bypass in MAT decoder when reading highly compressed dataImageMagick
- CVE-2026-107209ImageMagick: Use-After-Free in RSVG decoder that is build without cairo supportImageMagick
- CVE-2026-107208ImageMagick: Denial of service with crafted XMP profileImageMagick
- CVE-2026-106580ImageMagick: Policy Bypass in CUT encoderImageMagick
- CVE-2026-92415Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodiesApache Software Foundation Apache Jackrabbit
- CVE-2026-106579ImageMagick: Policy Bypass when using coder as the domain.ImageMagick
- CVE-2026-107273Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/sitegophish
- CVE-2026-107272Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messagesgophish
- CVE-2026-107271Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofinggophish
- CVE-2026-107278MISP Object Sync Drops Objects and Attributes When Description Is EmptyMISP
- CVE-2026-106578ImageMagick: Invalid Memory Free in MVG decoderImageMagick
- CVE-2026-107269Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancygophish
- CVE-2026-106577ImageMagick: Code Injection in the postscript codersImageMagick
- CVE-2026-106576ImageMagick: Denial of service possible when parsing an XMP profile.ImageMagick
- CVE-2026-107276MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent RequestsMISP
- CVE-2026-106575ImageMagick: Unclosed file pointer in magick scriptImageMagick
- CVE-2026-106574ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crashImageMagick
- CVE-2026-106573ImageMagick: Denial of service in MVG decoderImageMagick
- CVE-2026-106572ImageMagick: Stack Overflown CALS decoder due to missing depth check.ImageMagick
- CVE-2026-106571ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crashImageMagick
- CVE-2026-106570ImageMagick: Denial of service in distributed pixel cache serverImageMagick
- CVE-2026-106569ImageMagick: Denial of service in ASE decoder because of missing security checksImageMagick
- CVE-2026-106568ImageMagick: Infinite Loop when reading a crafted XMP profileImageMagick
- CVE-2026-107207LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist BypassLMCache
- CVE-2026-106567ImageMagick: Infinite Loop in PSD decoder on 32-bit buildsImageMagick
- CVE-2026-106566ImageMagick: Policy Bypass in delegate symlink cleanup due to missing checkImageMagick
- CVE-2026-106565ImageMagick: Infinite Loop in bzip2 compressed images.ImageMagick
- CVE-2026-106564ImageMagick: Heap Buffer Over-Write in EXR decoderImageMagick
- CVE-2026-33586Authenticated SMTP Sender Address ForgeryOVHcloud
- CVE-2026-106563Backstage: Improper entity validation in deprecated Kubernetes services endpointbackstage · @backstage plugin-kubernetes-backend +1
- CVE-2026-106562Backstage: Incorrect authorization in search engine permission filteringbackstage · @backstage plugin-search-backend +3
- CVE-2026-106561Backstage: Sensitive information disclosure in Kubernetes resource queriesbackstage · @backstage plugin-kubernetes-backend +1
- CVE-2026-106559Backstage: Improper input validation in Confluence to Markdown scaffolder modulebackstage · @backstage plugin-scaffolder-backend-module-… +1
- CVE-2026-107174Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extractionRed Hat OpenShift Serverless · Red Hat OpenShift Source-… +2
- CVE-2026-107169M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8Red Hat Enterprise Linux
- CVE-2026-107167M17n-lib: heap use-after-free write in re_init_ic()Red Hat Enterprise Linux
- CVE-2026-106064Gimp: gimp: heap buffer overflow in gif export on oversized image dimensionsRed Hat Enterprise Linux
- CVE-2026-104074Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERROR-CODEcoturn
- CVE-2026-62179PraisonAI: Platform members can delete owner issue dependencies through member-owned related issuesMervinPraison praisonai-platform · praisonai-platform
- CVE-2026-107125XnView Classic FLI File heap-based overflowXnView Classic
- CVE-2026-46438wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entrywger-project wger · wger
- CVE-2026-46437wger: API credentials remain valid after logout/password changewger-project wger · wger
- CVE-2026-45161wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingwger-project wger · wger
- CVE-2026-102258Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) whSonicWall SMA1000
- CVE-2026-98373mm/hugetlb: preserve mremap address delta when skipping page tablesLinux
- CVE-2026-41958A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)).visidata
- CVE-2026-42532A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)).visidata
- CVE-2026-107170M17n-lib: null dereference in minput_open_im() after failed m17n_init()Red Hat Enterprise Linux
- CVE-2026-107175MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group ChangesMISP
- CVE-2026-107168M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()Red Hat Enterprise Linux
- CVE-2026-107151Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requestsRed Hat Satellite
- CVE-2026-105140Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 Race Condition Restores Revoked Group Membershipobot-platform obot
- CVE-2026-105139Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resourcesobot-platform obot
- CVE-2026-27434WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerabilitysc Internet Vivoo WP Rentals
- CVE-2026-104390WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerabilityArraytics Booktics
- CVE-2026-105876WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-97146Apache YuniKorn: Admission control bypass via system label forgeryApache Software Foundation Apache YuniKorn
- CVE-2026-104393WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerabilityweDevs Happy Addons for Elementor
- CVE-2026-78243Apache YuniKorn: LDAP Group provider panics on lowercase attribute nameApache Software Foundation Apache YuniKorn
- CVE-2026-105875WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerabilityBdThemes Prime Slider – Addons For Elementor
- CVE-2026-92393Apache YuniKorn: Admission control bypass via workload UPDATE operationApache Software Foundation Apache YuniKorn
- CVE-2026-104391WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2026-103075WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerabilityWPMU DEV Hustle
- CVE-2026-105884WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerabilityWP Media Rocket Lazy Load
- CVE-2026-105873WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2026-97294WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2026-105871WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerabilityBdThemes Element Pack Elementor Addons
- CVE-2025-64391This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locatiVeeam Agent for Windows
- CVE-2025-64392This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craftVeeam Backup Enterprise Manager
- CVE-2026-93026This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus updVeeam Backup and Replication
- CVE-2026-58068This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.Veeam Agent for Windows
- CVE-2026-93684Apache Impala: Stored XSS in Impala query plansApache Software Foundation Apache Impala
- CVE-2026-90466Apache Impala: Path traversal executes JARs outside trusted pathsApache Software Foundation Apache Impala
- CVE-2026-102781Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6ordasoft.com Touch Slider extension for Joomla
- CVE-2026-107121Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgradeRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-105322Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact FormMagee Shortcodes
- CVE-2026-86833MetForm < 4.3.1 - Unauthenticated HTML Injection in Notification Emails via Field ShortcodesMetForm
- CVE-2026-97354PowerPress 11.13.12 - 11.17.9 - Contributor+ SSRF via Media URL RedirectsPowerPress Podcasting plugin by Blubrry
- CVE-2026-97331User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_accessUser Private Files
- CVE-2026-96530Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard WidgetOptimole
- CVE-2026-86816WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST APIWPCafe
- CVE-2026-104953MPG < 4.2.3 - Editor+ SQLi via Project ImportMPG
- CVE-2026-104678CP Media Player < 1.3.4 - Contributor+ Media Player Settings UpdateCP Media Player
- CVE-2026-104667Animated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter OrderAnimated Number Counters
- CVE-2026-104653Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop DimensionsEnvira Gallery
- CVE-2026-104652Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image IDEnvira Gallery
- CVE-2026-104651Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDORYaad Sarig Payment Gateway For WC
- CVE-2026-104050Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answersAcademy LMS
- CVE-2026-104049Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST EndpointAcademy LMS
- CVE-2026-103681Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_deleteFrontend Dashboard
- CVE-2026-103378Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log FileGeliver Akıllı Kargo Pazaryeri
- CVE-2026-103323Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue DisclosureIntegration for Epos Now and WooCommerce
- CVE-2026-103870Pulp-rpm: distribution tree publish creates directories from .treeinfo idsRed Hat Satellite · Red Hat Update Infrastructure 4 for… +1
- CVE-2026-103869Pulp-ansible: bearer tokens are reused across remotes in a workerRed Hat Ansible Automation Platform · Red Hat Satellite
- CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a workerRed Hat Ansible Automation Platform · Red Hat Satellite +2
- CVE-2026-84897wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusionwolfSSL wolfSSH
- CVE-2026-83742wstrncat() unsigned integer underflow leads to an off-by-one null write in wolfSSH on non-Windows platformswolfSSL wolfSSH
- CVE-2026-81535wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization checkwolfSSL wolfSSH
- CVE-2026-106061Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted fileRed Hat Enterprise Linux
- CVE-2026-93448Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-93679Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-97671Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2025-70515The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.
- CVE-2025-70519The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.
- CVE-2026-46571In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read poss
- CVE-2026-88514An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.