415128CVEs tracked
4633Last 7 days
16419Last 30 days
1756CISA KEV
Recently published CVEs
4633 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-105199 | 6.8
CISA-ADP (via NVD) v3.1 |
NetworkAdminUser action
C:HI:HA:H
|
0.2% | Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager… The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the … |
2026-10-24 |
| CVE-2026-115807 | 7.1
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:LI:HA:N
|
0.3% | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor… The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, … |
2026-10-24 |
| CVE-2026-115806 | 9.8
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.8% | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment dur… The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration se… |
2026-10-24 |
| CVE-2026-115929 | 6.8
CNA (via NVD) v3.1 |
NetworkNo authUser actionConditions
C:HI:HA:N
|
0.2% | MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store has the recoverable eMudhra intermediate CA certificates. Issue i… |
2026-10-24 |
| CVE-2026-115931 | 9.9
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
Scope change
C:HI:HA:H
|
0.6% | Arbitrary file read and backend crash through unrestricted provider method calls Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper f… |
2026-10-23 |
| CVE-2026-110814 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-23 |
| CVE-2026-108793 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-23 |
| CVE-2026-108537 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-23 |
| CVE-2026-115938 | 8.8
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:HA:H
|
0.7% | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RC… Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter deleg… |
2026-10-23 |
| CVE-2026-115937 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:HA:N
|
0.2% | Unauthenticated payment reuse allows unpaid orders to be marked as paid The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transacti… |
2026-10-23 |
| CVE-2026-115935 | 8.8
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:HA:H
|
0.7% | Control panel only API response emulation replaces "securityKey" and reaches server RCE The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-… |
2026-10-23 |
| CVE-2026-115897 | 2.1
CNA (via NVD) v4.0 |
NetworkLoginUser actionConditions
Scope change
C:LI:LA:N
|
0.4% | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a se… Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare c… |
2026-10-23 |
| CVE-2026-115895 | 8.8
CNA (via NVD) v3.1 |
NetworkNo authUser action
C:HI:HA:H
|
0.6% | Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code … Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0 until 21.0.4, packages/happy-dom/src/module/ECMAScriptModuleCompiler.ts accepts a named ESM … |
2026-10-23 |
| CVE-2026-115893 | 9.9
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
Scope change
C:HI:HA:H
|
0.8% | Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_tabl… Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targ… |
2026-10-23 |
| CVE-2026-115892 | 5.7
CNA (via NVD) v4.0 |
NetworkAdminUser actionConditions
C:NI:NA:H
|
0.6% | Wasmtime: Panic lowering a host-created component model stream into a guest that expects a… Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a guest can omit a required payload-type check after the value… |
2026-10-23 |
| CVE-2026-115889 | 9.9
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
Scope change
C:HI:HA:H
|
0.7% | Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a su… |
2026-10-23 |
| CVE-2026-115887 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.7% | graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas. From 1.24.1 until 2.0.1, GraphQLPhoneNumber in src/scalars/PhoneNumber.ts uses ambiguous nested d… |
2026-10-23 |
| CVE-2026-115886 | 6.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:LA:N
|
0.4% | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer… MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, the scorer invoke, register, and GenAI evaluate endpoints,… |
2026-10-23 |
| CVE-2026-115885 | 4.1
CNA (via NVD) v4.0 |
LocalLoginUser actionConditions
C:HI:NA:N
|
0.2% | LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --… |
2026-10-23 |
| CVE-2026-115883 | 6.0
CNA (via NVD) v4.0 |
NetworkLoginNo interactionConditions
C:HI:LA:N
|
0.4% | LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite s… LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2… |
2026-10-23 |
| CVE-2026-115801 | 5.3
CNA (via NVD) v3.1 |
LocalLoginNo interaction
PoC
C:LI:LA:L
|
0.2% | Kakao khaiii JSON Config File Linear.cpp open out-of-bounds A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config … |
2026-10-23 |
| CVE-2026-83813 | 3.1
CNA (via NVD) v3.1 |
AdjacentNo authNo interactionConditions
C:NI:LA:N
|
0.2% | Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when it… |
2026-10-23 |
| CVE-2026-75525 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.2% | OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient direct… OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 p… |
2026-10-23 |
| CVE-2026-75524 | 5.4
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:NI:LA:L
|
0.3% | OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping ap… OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a… |
2026-10-23 |
| CVE-2026-65825 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
Scope change
C:HI:LA:N
|
0.3% | OpenReception: one tenant's throttle row disables the PIN brute-force throttle for the sam… OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced … |
2026-10-23 |
| CVE-2026-65824 | 7.4
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:HA:N
|
0.4% | OpenReception: invite confirmation token is replayable within its validity window and re-i… OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obt… |
2026-10-23 |
| CVE-2026-58202 | 8.3
CNA (via NVD) v3.1 |
NetworkNo authUser action
C:HI:HA:L
|
0.4% | OpenReception: Confirmation-email links built from the request Host enable pending-account… OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.0.0, the account-confirmation link in emails is built from the request Ho… |
2026-10-23 |
| CVE-2026-57849 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-23 |
| CVE-2026-115877 | 5.4
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
Scope change
C:LI:LA:N
|
0.3% | Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but a… |
2026-10-23 |
| CVE-2026-115800 | 5.3
CNA (via NVD) v3.1 |
LocalLoginNo interaction
PoC
C:LI:LA:L
|
0.2% | UbiquitousLearning mllm Convertor __init__.py load_model path traversal A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the component Convertor. The m… |
2026-10-23 |
| CVE-2026-115778 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.7% | Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport vi… Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persi… |
2026-10-23 |
| CVE-2026-115776 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.7% | Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbound… Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed … |
2026-10-23 |
| CVE-2026-115775 | 8.7
CNA (via NVD) v4.0 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.7% | Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element … Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote pee… |
2026-10-23 |
| CVE-2026-115774 | 4.9
CNA (via NVD) v3.1 |
NetworkAdminNo interaction
C:NI:NA:H
|
0.6% | Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEAR… Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches twisted.mail.imap4.parseNestedParens with a negative … |
2026-10-23 |
| CVE-2026-113951 | — | Not scored | 0.2% | If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host … | 2026-10-23 |
| CVE-2026-113877 | — | Not scored | 0.3% | HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-La… HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each Accept-Language range into th… |
2026-10-23 |
| CVE-2026-79982 | 8.8
CNA (via NVD) v3.1 |
AdjacentNo authNo interaction
C:HI:HA:H
|
0.4% | Out-of-bounds write in the USB Bluetooth HCI transport class when a controller-to-host HCI… The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer before enqueuing it on a… |
2026-10-23 |
| CVE-2026-79981 | 6.5
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:LI:HA:N
|
0.2% | DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoof… The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() -> register_dispatcher() -> dns_dis… |
2026-10-23 |
| CVE-2026-79980 | 5.6
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:LI:LA:L
|
0.3% | Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconf… The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value. It was seeded once with… |
2026-10-23 |
| CVE-2026-79979 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interactionConditions
Scope change
C:HI:HA:H
|
0.1% | Stale TLB entries after demand-paging page-out let arm64 user threads access reused physic… The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt >> 12. That operand enco… |
2026-10-23 |
| CVE-2026-79978 | 3.6
CNA (via NVD) v3.1 |
LocalLoginNo interactionConditions
C:NI:LA:L
|
0.1% | Out-of-bounds write in the ADXL345 sensor driver RTIO streaming FIFO read path The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len = MIN(fifo_bytes, buf_av… |
2026-10-23 |
| CVE-2026-79977 | 8.2
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:NA:H
|
0.2% | WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-pa… The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handle_transport_data(), when the 32-bit receiver index of an incoming… |
2026-10-23 |
| CVE-2026-19741 | 7.5
CNA (via NVD) v3.1 |
AdjacentNo authNo interactionConditions
C:HI:HA:H
|
0.3% | OpenThread joiner autostart uses a publicly documented default Joining Device Credential (… Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig, then subsys/net/l2/openth… |
2026-10-23 |
| CVE-2026-115797 | 3.7
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
PoC
C:LI:NA:N
|
0.3% | Tenda F6 Web Management cleartext transmission A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartex… |
2026-10-23 |
| CVE-2026-115796 | 4.3
CNA (via NVD) v3.1 |
NetworkNo authUser action
PoC
C:NI:LA:N
|
0.2% | Tenda F6 Web Management cross-site request forgery A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the component Web Management Interface. Performing a manipulation results in cross-site request forgery… |
2026-10-23 |
| CVE-2026-115586 | 7.1
CNA (via NVD) v4.0 |
LocalNo authActive actionConditions
C:HI:HA:H
|
0.2% | virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is o… virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escapi… |
2026-10-23 |
| CVE-2026-115585 | 7.1
CNA (via NVD) v4.0 |
NetworkNo authUser action
C:NI:NA:H
|
0.5% | pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete… |
2026-10-23 |
| CVE-2026-115580 | 7.1
CNA (via NVD) v4.0 |
NetworkNo authUser action
C:NI:NA:H
|
0.5% | pypdf: Possible long runtimes for large xref table header limits pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain… |
2026-10-23 |
| CVE-2026-115572 | 7.1
CNA (via NVD) v4.0 |
NetworkNo authUser action
C:NI:NA:H
|
0.5% | pypdf: Possible long runtimes for repeated references to the same missing object pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an attacker can craft a PDF that repeatedly references the same nonexistent indirect object, causing relevant file parts such … |
2026-10-23 |
| CVE-2026-91093 | 8.5
CNA (via NVD) v4.0 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | HP One Agent Software – Security Update A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is r… |
2026-10-23 |