415128CVEs tracked
4618Last 7 days
16055Last 30 days
1756CISA KEV
Recently published CVEs
4618 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-93639 | 8.7
CNA (via NVD) v3.1 |
NetworkLoginUser action
Scope change
C:HI:HA:N
|
0.4% | Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Admi… A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no explicit administrative grants to overwrite global Zimlet configuration through Confi… |
2026-10-23 |
| CVE-2026-93638 | 6.1
CNA (via NVD) v3.1 |
NetworkNo authUser action
Scope change
C:LI:LA:N
|
0.3% | Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Pag… A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A craft… |
2026-10-23 |
| CVE-2026-93636 | 4.3
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:LI:NA:N
|
0.3% | Zimbra Collaboration Suite LDAP Filter Injection via Calendar Resource Attribute Name An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar resources through SearchCalendarResourcesRe… |
2026-10-23 |
| CVE-2026-93634 | 4.3
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:NI:LA:N
|
0.3% | Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Recor… A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRe… |
2026-10-23 |
| CVE-2026-93633 | 5.4
CNA (via NVD) v3.1 |
NetworkLoginUser action
Scope change
C:LI:LA:N
|
0.2% | Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Char… A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays attacker-controlled content under the Zimbra… |
2026-10-23 |
| CVE-2026-93631 | 7.1
CNA (via NVD) v3.1 |
NetworkNo authUser action
C:HI:LA:N
|
0.2% | Zimbra Collaboration Suite OAuth Extension Cross-Site Request Forgery Enables Account Link… A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an attacker-controlled external account to a victim's m… |
2026-10-23 |
| CVE-2026-93630 | 4.3
CNA (via NVD) v3.1 |
NetworkNo authUser action
C:NI:LA:N
|
0.4% | Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to bypass the restriction on forms that target the Zimbra ho… |
2026-10-23 |
| CVE-2026-93629 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.4% | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar … An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to insert calendar invitations attributed to another user. The email delivery path … |
2026-10-23 |
| CVE-2026-93628 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.4% | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar … An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to forge another attendee's response to an existing meeti… |
2026-10-23 |
| CVE-2026-93627 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.4% | Zimbra Collaboration Suite Calendar Processing Authentication Bypass via Forged iCalendar … An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an unauthenticated sender to cancel or modify an existing meeting in a recipient's… |
2026-10-23 |
| CVE-2026-57208 | 6.2
CNA (via NVD) v4.0 |
NetworkLoginActive action
Scope change
C:NI:LA:N
|
0.5% | Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write duri… Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path traversal vulnerability in Entire CLI allows an attacker with push access to the checkpoints repository… |
2026-10-23 |
| CVE-2026-57207 | 5.9
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:NA:N
|
0.4% | NetBox MCP Server: HTTP transport exposes all NetBox data without authentication NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. A… |
2026-10-23 |
| CVE-2026-55826 | 8.7
CNA (via NVD) v4.0 |
NetworkNo authNo interaction
C:HI:NA:N
|
0.6% | Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulati… The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an u… |
2026-10-23 |
| CVE-2026-55606 | 6.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:NA:L
|
0.5% | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length va… |
2026-10-23 |
| CVE-2026-53921 | 9.8
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.9% | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) … |
2026-10-23 |
| CVE-2026-53920 | 8.7
CNA (via NVD) v4.0 |
NetworkNo authNo interaction
C:HI:NA:N
|
0.5% | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is … |
2026-10-23 |
| CVE-2026-53918 | 8.8
CNA (via NVD) v4.0 |
NetworkNo authNo interaction
C:NI:LA:H
|
0.7% | odhcpd DHCPv6 IA dangling first pointer use-after-free odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in on… |
2026-10-23 |
| CVE-2026-50057 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permis… A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits p… |
2026-10-23 |
| CVE-2026-50056 | 7.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
C:HI:HA:H
|
0.2% | Zimbra Collaboration Suite Local Privilege Escalation via zmmailboxdmgr JVM Argument Injec… A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account to execute arbitrary commands as root. The passwordless sudo… |
2026-10-23 |
| CVE-2026-50053 | 8.7
CNA (via NVD) v3.1 |
NetworkLoginUser action
Scope change
C:HI:HA:N
|
0.4% | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL P… A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/* to populate servlet attributes intended for trusted internal dispatch. RestFilter… |
2026-10-23 |
| CVE-2026-115786 | 6.5
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:NI:NA:H
|
0.4% | Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaus… A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creatio… |
2026-10-23 |
| CVE-2026-115785 | 4.3
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:NI:LA:N
|
1.0% | Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email A… An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary authenticated user with account options enabled to inject CR/LF … |
2026-10-23 |
| CVE-2026-115754 | 4.7
CNA (via NVD) v3.1 |
NetworkNo authUser actionConditions
Scope change
C:LI:LA:N
|
0.3% | serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an … |
2026-10-23 |
| CVE-2026-115481 | 8.5
CNA (via NVD) v4.0 |
NetworkLoginActive action
C:HI:HA:H
|
0.5% | baserCMS: BcCustomContent file fields can be configured to allow executable file extension… baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService::build()` reads a plugin's `config/permission.php` to decid… |
2026-10-23 |
| CVE-2026-115480 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.4% | baserCMS: Public Web API mail-form submission bypasses image CAPTCHA baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the public POST /baser/api/bc-mail/mail_messages/add/{mailContentId}.json endpoint accepts submissio… |
2026-10-23 |
| CVE-2026-115479 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
0.4% | baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email f… |
2026-10-23 |
| CVE-2026-115457 | 7.1
CNA (via NVD) v3.1 |
NetworkNo authUser action
C:HI:LA:N
|
0.4% | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the complete rendered page, including HTML-escaped blog comment… |
2026-10-23 |
| CVE-2026-114624 | 7.2
CNA (via NVD) v3.1 |
NetworkAdminNo interaction
C:HI:HA:H
|
0.9% | baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a stri… |
2026-10-23 |
| CVE-2026-114623 | 6.5
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:NA:N
|
0.6% | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory … |
2026-10-23 |
| CVE-2026-114622 | 7.2
CNA (via NVD) v3.1 |
NetworkAdminNo interaction
C:HI:HA:H
|
0.7% | baserCMS: Encoded path traversal bypass in the theme file API baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update() and … |
2026-10-23 |
| CVE-2026-114621 | 8.8
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:HA:H
|
0.7% | baserCMS: SQL injection in the admin panel and admin API baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including… |
2026-10-23 |
| CVE-2026-114357 | 9.3
CNA (via NVD) v4.0 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.5% | DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0) Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated she… |
2026-10-23 |
| CVE-2026-114356 | 7.0
CNA (via NVD) v4.0 |
LocalNo authNo interaction
C:NI:HA:H
|
0.2% | DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without author… Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke… |
2026-10-23 |
| CVE-2026-114355 | 8.6
CNA (via NVD) v4.0 |
LocalNo authNo interaction
C:HI:HA:H
|
1.0% | DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary co… |
2026-10-23 |
| CVE-2026-114354 | 8.6
CNA (via NVD) v4.0 |
LocalNo authNo interaction
C:HI:HA:H
|
0.2% | DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with n… |
2026-10-23 |
| CVE-2026-114353 | 7.0
CNA (via NVD) v4.0 |
PhysicalNo authNo interaction
C:HI:HA:H
|
0.2% | DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with … |
2026-10-23 |
| CVE-2026-10632 | 8.7
CNA (via NVD) v3.1 |
NetworkLoginUser action
Scope change
C:HI:HA:N
|
0.4% | Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document … A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an attacker to inject JavaScript through the packages parameter of the /h/rest docum… |
2026-10-23 |
| CVE-2026-99087 | — | Not scored | 0.2% | dm-integrity: fix NULL pointer dereference when the 'R' flag is used In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag … |
2026-10-23 |
| CVE-2026-99086 | — | Not scored | 0.2% | dm-integrity: validate the superblock on resume In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up … |
2026-10-23 |
| CVE-2026-99085 | — | Not scored | 0.2% | sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its ho… |
2026-10-23 |
| CVE-2026-99084 | — | Not scored | 0.2% | readdir: take no inode lock on an immutable directory In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared and holds it across ->ite… |
2026-10-23 |
| CVE-2026-99083 | 8.8
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:HA:H
|
0.2% | ksmbd: fix heap out-of-bounds write in krb5_authenticate() In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5_authenticate() In krb5_authenticate(), out_len is calculated to determine available he… |
2026-10-23 |
| CVE-2026-99082 | 8.8
CNA (via NVD) v3.1 |
LocalLoginNo interaction
Scope change
C:HI:HA:H
|
0.2% | KVM: x86: Use active memslots for the per-vCPU MMIO cache In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a mem… |
2026-10-23 |
| CVE-2026-99081 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:NA:H
|
0.2% | bnxt_en: fix DMA mapping length for padded small packets In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXt… |
2026-10-23 |
| CVE-2026-99080 | — | Not scored | 0.2% | fs: Free any excess xarray nodes in clear_inode() In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clear_inode() For many years we've had a hard to hit leak of xarray nodes. Hugh documented it… |
2026-10-23 |
| CVE-2026-99079 | 9.8
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.2% | net/mlx5e: Prevent stale XSK buffer release on refill retry In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on refill retry When an XDP redirect to an AF_XDP socket fails because its RX ring is … |
2026-10-23 |
| CVE-2026-99078 | 9.8
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:H
|
0.2% | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AF_XDP on a striding RQ, mlx5e defers releasing XSK buffers… |
2026-10-23 |
| CVE-2026-99077 | 7.4
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:HI:HA:N
|
0.2% | ipv4: udp: Create exceptions before socket matching In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are loc… |
2026-10-23 |
| CVE-2026-99076 | — | Not scored | 0.2% | ipv6: udp: Create exceptions before socket matching In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally… |
2026-10-23 |
| CVE-2026-99075 | — | Not scored | 0.2% | rust_binder: reschedule node refcount update on thread exit In the Linux kernel, the following vulnerability has been resolved: rust_binder: reschedule node refcount update on thread exit When a thread exits via BINDER_THREAD_EXIT, its pending work items are… |
2026-10-23 |