# CVEs published 2020-10-10

6 CVEs were published on October 10, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-26948](https://cve.now/CVE-2020-26948.md): Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. (no CVSS)
- [CVE-2020-26947](https://cve.now/CVE-2020-26947.md): monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . (no CVSS)
- [CVE-2020-26945](https://cve.now/CVE-2020-26945.md): MyBatis before 3.5.6 mishandles deserialization of object streams. (no CVSS, org.mybatis:mybatis)
- [CVE-2020-26934](https://cve.now/CVE-2020-26934.md): phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2020-26935](https://cve.now/CVE-2020-26935.md): An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. (no CVSS, phpmyadmin/phpmyadmin)
- [CVE-2020-26932](https://cve.now/CVE-2020-26932.md): debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa\_newaliases-wrapper, whereas the intended pe (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.