{"lastUpdated":"2026-10-12T21:50:25.867Z","sourceStatus":{"CISA KEV":{"last_success":"2026-10-12T18:20:31.602Z","last_attempt":"2026-10-12T18:20:31.602Z","error":null,"in_progress":false},"NVD":{"last_success":"2026-10-12T20:00:36.502Z","last_attempt":"2026-10-12T20:00:36.502Z","error":null,"in_progress":false},"GitHub Advisories":{"last_success":"2026-10-12T18:20:33.836Z","last_attempt":"2026-10-12T18:20:33.836Z","error":null,"in_progress":false},"CERT/CC":{"last_success":"2026-10-12T18:20:31.826Z","last_attempt":"2026-10-12T18:20:31.826Z","error":null,"in_progress":false},"SecurityWeek":{"last_success":"2026-10-12T18:20:30.177Z","last_attempt":"2026-10-12T18:20:30.177Z","error":null,"in_progress":false},"The Hacker News":{"last_success":"2026-10-12T18:20:32.298Z","last_attempt":"2026-10-12T18:20:32.298Z","error":null,"in_progress":false},"Krebs on Security":{"last_success":"2026-10-12T18:20:31.590Z","last_attempt":"2026-10-12T18:20:31.590Z","error":null,"in_progress":false},"CyberScoop":{"last_success":"2026-10-12T18:20:30.176Z","last_attempt":"2026-10-12T18:20:30.176Z","error":null,"in_progress":false},"CVEProject":{"last_success":null,"last_attempt":"2026-10-12T18:51:37.722Z","error":null,"in_progress":true},"EPSS":{"last_success":"2026-10-12T21:50:25.867Z","last_attempt":"2026-10-12T21:50:25.867Z","error":null,"in_progress":false}},"filters":{"source":"","category":"","vendor":"","search":""},"count":1000,"totalMatching":4095,"articles":[{"id":"https://cyberscoop.com/?p=91063","title":"IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion","source":"CyberScoop","date":"2026-10-12T18:12:10.000Z","summary":"The acquisition pairs Elisity's zero-trust access controls with IonQ's post-quantum cryptography business as federal agencies and major companies accelerate timelines for quantum-ready encryption.  3 billion appeared first on CyberScoop .","url":"https://cyberscoop.com/ionq-acquires-elisity-1-3-billion-quantum-security/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91063"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/ionq-acquires-elisity-1-3-billion-quantum-security/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html","title":"⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More","source":"The Hacker News","date":"2026-10-12T15:16:26.000Z","summary":"Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week.  Within hours, they were already testing it.","url":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.html"}],"epss":null},{"id":"CVE-2026-103521","title":"VU#162329: Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1","source":"CERT/CC","date":"2026-10-12T14:52:17.431Z","summary":"1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows.  Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces.","url":"https://kb.cert.org/vuls/id/162329","topic":"Coordinated disclosures","read":false,"aliasText":"Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution (RCE), server-side template injection (SSTI), stored and reflected cross-site scripting (XSS), unauthorized URL redirection, and other risks that expose both server-side and client-side attack surfaces. Description Thelia is an open-source e-commerce platform designed to provide merchants with customizable online storefronts, product management workflows, and administrative functionalities. It utilizes the Smarty template engine and provides administrators with broad control over templates, content, and modules. CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such as malicious PHP scripts, to achieve remote code execution on the underlying server. CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client-supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the underlying server. CVE-2026-103523 Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the \"Add New Address\" form, the application redirects them to the URL specified in the next parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website. CVE-2026-103524 Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation. CVE-2026-103526 In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale. CVE-2026-103527 Thelia v2.6.0's Smarty templates ( address.html and address-update.html ) fail to properly escape double quotes in the next parameter, enabling reflected XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript. CVE-2026-103528 Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered, functions such as system() , exec() , file_put_contents() , and file_get_contents() can be executed with the privileges of the web process. This allows arbitrary OS command execution, file read/write operations, and RCE on the server. CVE-2026-103529 Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install() method which will then be executed upon installation, enabling remote code execution with the privileges of the web server. CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item_name parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../ , allowing an authenticated user with UPDATE -level permission on admin.configuration.language to write files outside templates/ , including to web-accessible directories. Separately, the translation-writing logic does not escape \\ in user-supplied values, allowing input to break out of the PHP string literal and inject executable code into the translation file. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with the web server's privileges. CVE-2026-103537 Thelia v2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The checkTemplate() validation restricts relative directory traversal sequences such as ../ but does not reject absolute paths, allowing an authorized user to supply an arbitrary filesystem path as a template. Smarty then loads and compiles the referenced file without an effective security policy, so, depending on filesystem layout and deployment configuration, template code in that file can be executed with the web server's privileges. Impact Several of these vulnerabilities allow authenticated administrative users to achieve arbitrary code execution on the host server. These include insufficient file validation and unsafe upload/update workflows (CVE-2026-103521 and CVE-2026-103522), unrestricted execution of PHP code during module installation (CVE-2026-103529), unsafe template evaluation for email content (CVE-2026-103528), server side template injection via absolute paths (CVE-2026-103537), and flaws in the translation writing process that permit path traversal and PHP injection (CVE-2026-103535). Exploitation of any of these issues can result in complete compromise of the underlying application environment with the privileges of the web server. Separately, user-supplied content rendered within administrative templates enables stored and reflected XSS. CVE-2026-103524 allows persistent JavaScript execution within the admin interface, while CVE-2026-103527 enables reflected JavaScript injection via unescaped template parameters. These vulnerabilities allow attackers to hijack administrative sessions and perform privileged actions in the browser context of other authenticated users. The discrepancies in authentication error-handling identified in CVE-2026-103526 allow unauthenticated attackers to easily enumerate valid administrative usernames, increasing the risk and effectiveness of subsequent brute-forcing or authentication-related attacks. Finally, the open redirect described in CVE-2026-103523 allows attackers to redirect users to external attacker-controlled websites, increasing the effectiveness of phishing or other downstream attacks. Together, these vulnerabilities facilitate full server takeover for authenticated administrative attackers, and expose avenues for browser-based compromise or credential attacks to both authenticated and unauthenticated attackers. Solution Unfortunately, we were unable to coordinate these vulnerabilities with Thelia, and a patch is not yet available. To reduce risk until these issues are remediated, users and organizations should restrict access to Thelia administrative interfaces, disable or tightly limit file-upload and template-editing features, and remove PHP execution permissions from user-writable directories wherever possible. Applying strict reverse-proxy controls such as rate limiting, MIME filtering, and URL allowlisting can further reduce exposure. Acknowledgements Thanks to the reporters K08UK0VU, s-b321, DuanNH, Deflask13, LongNBH, and NNPhong (pnn219) from ETC JSC security team for researching and reporting these vulnerabilities. This document was written by Molly Jaconski.","kev":false,"cvss":null,"aliases":["CVE-2026-103521","CVE-2026-103522","CVE-2026-103523","CVE-2026-103524","CVE-2026-103526","CVE-2026-103527","CVE-2026-103528","CVE-2026-103529","CVE-2026-103535","CVE-2026-103537"],"recordIds":["https://kb.cert.org/vuls/id/162329"],"sources":["CERT/CC"],"topics":["Coordinated disclosures"],"affected":[],"references":[{"source":"CERT/CC","url":"https://kb.cert.org/vuls/id/162329"}],"epss":null},{"id":"https://www.securityweek.com/?p=49951","title":"IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion","source":"SecurityWeek","date":"2026-10-12T14:25:00.000Z","summary":"The all-stock deal brings Elisity’s least-privilege access technology into IonQ’s security portfolio.  3 Billion appeared first on SecurityWeek .","url":"https://www.securityweek.com/ionq-to-acquire-zero-trust-firm-elisity-for-up-to-1-3-billion/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49951"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/ionq-to-acquire-zero-trust-firm-elisity-for-up-to-1-3-billion/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49949","title":"Bricksforge WordPress Plugin Vulnerability Exploited in the Wild","source":"SecurityWeek","date":"2026-10-12T13:14:37.000Z","summary":"The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.  The post Bricksforge WordPress Plugin Vulnerability Exploited in the Wild appeared first on SecurityWeek .","url":"https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49949"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/bricksforge-wordpress-plugin-vulnerability-exploited-in-the-wild/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49946","title":"Canonical Websites Disrupted in Second DDoS Attack This Year","source":"SecurityWeek","date":"2026-10-12T11:58:39.000Z","summary":"The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal.  The post Canonical Websites Disrupted in Second DDoS Attack This Year appeared first on SecurityWeek .","url":"https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49946"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/canonical-websites-disrupted-in-second-ddos-attack-this-year/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html","title":"Bring Your Own Agent: Your Employees' Assistants Are Already Logged In","source":"The Hacker News","date":"2026-10-12T11:55:00.000Z","summary":"The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta's Muse because it doesn't identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up.  Regardless, the tech world is mesmerized by the capabilities and potential of these services.","url":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/bring-your-own-agent-your-employees.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49944","title":"Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US","source":"SecurityWeek","date":"2026-10-12T11:24:50.000Z","summary":"Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.  The post Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US appeared first on SecurityWeek .","url":"https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49944"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html","title":"Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports","source":"The Hacker News","date":"2026-10-12T11:21:48.000Z","summary":"Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.  On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis.","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49938","title":"iRhythm Data Breach Impacts at Least 360,000 People","source":"SecurityWeek","date":"2026-10-12T11:05:43.000Z","summary":"Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.  The post iRhythm Data Breach Impacts at Least 360,000 People appeared first on SecurityWeek .","url":"https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49938"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/irhythm-data-breach-impacts-over-360000-people/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html","title":"Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch","source":"The Hacker News","date":"2026-10-12T10:36:56.000Z","summary":"Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.  0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker \"to direct the appliance to issue requests on their","url":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49936","title":"Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe","source":"SecurityWeek","date":"2026-10-12T10:32:05.000Z","summary":"The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.  The post Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe appeared first on SecurityWeek .","url":"https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49936"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/"}],"epss":null},{"id":"https://cyberscoop.com/?p=91050","title":"Your AI agent is only as safe as the packages it downloads","source":"CyberScoop","date":"2026-10-12T10:00:00.000Z","summary":"NVIDIA's new agent safety platform puts enforcement in the right place.  It still must know what it is letting through.","url":"https://cyberscoop.com/ai-agent-software-supply-chain-security-op-ed/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91050"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/ai-agent-software-supply-chain-security-op-ed/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html","title":"Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE","source":"The Hacker News","date":"2026-10-12T09:02:14.000Z","summary":"A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack.  0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE).","url":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/attackers-exploit-cvss-100-bricksforge.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49933","title":"Critical SonicWall Vulnerability Exploited Days After Disclosure","source":"SecurityWeek","date":"2026-10-12T08:36:01.000Z","summary":"CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.  The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek .","url":"https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49933"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49930","title":"Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch","source":"SecurityWeek","date":"2026-10-12T07:53:28.000Z","summary":"Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.  The post Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch appeared first on SecurityWeek .","url":"https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49930"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/lets-encrypt-cuts-default-certificate-validity-to-64-days-ahead-of-45-day-switch/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html","title":"CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records","source":"The Hacker News","date":"2026-10-12T07:26:12.000Z","summary":"Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.  The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed","url":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html","title":"P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands","source":"The Hacker News","date":"2026-10-11T04:24:34.000Z","summary":"Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword.  \"Compared with the variants we usually observe, P7 reduces its on-device footprint, adds on-device keychain and crypto-wallet theft, and adds two way C2 communication with the attacker's infrastructure,\" iVerify said in a new report published Thursday.","url":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/p7-darksword-ios-exploit-kit-adds.html"}],"epss":null},{"id":"https://cyberscoop.com/?p=91055","title":"Canadian cybersecurity executive arrested in federal extortion case","source":"CyberScoop","date":"2026-10-10T13:35:50.000Z","summary":"Details of the case align with the investigation into ShinyHunters’ attack on FBI IT systems.  The post Canadian cybersecurity executive arrested in federal extortion case appeared first on CyberScoop .","url":"https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91055"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49925","title":"Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison","source":"SecurityWeek","date":"2026-10-10T11:00:00.000Z","summary":"The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers.  The post Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison appeared first on SecurityWeek .","url":"https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49925"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/insider-cyber-extortion-plot-against-industrial-firm-lands-engineer-in-prison/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html","title":"The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't","source":"The Hacker News","date":"2026-10-10T11:00:00.000Z","summary":"In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI.  About 282 of them sit behind single sign-on.","url":"https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/the-third-party-agent-problem-why.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html","title":"Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws","source":"The Hacker News","date":"2026-10-10T09:18:45.000Z","summary":"Anthropic on Friday said it's cutting off live internet access for all its internal evaluations until further notice following the discovery of new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior and targeted real websites.  The AI company said it identified four broad categories of unintended model actions during evaluations and internal use of Claude","url":"https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/anthropic-cuts-live-internet-access-for.html"}],"epss":null},{"id":"CVE-2026-101947","title":"CVE-2026-101947 — ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and i","summary":"ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.","source":"NVD","date":"2026-10-10T04:18:06.413Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101947","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101947"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"help@fluidattacks.com"},"read":false,"kev":false,"recordIds":["CVE-2026-101947"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101947"}],"epss":null},{"id":"https://krebsonsecurity.com/?p=74440","title":"FBI Arrests Executive at Ransomware Negotiation Firm","source":"Krebs on Security","date":"2026-10-10T00:17:42.000Z","summary":"Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of agents, multiple sources tell KrebsOnSecurity. Read the original report for details.","url":"https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://krebsonsecurity.com/?p=74440"],"sources":["Krebs on Security"],"topics":["Cyber news"],"affected":[],"references":[{"source":"Krebs on Security","url":"https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/"}],"epss":null},{"id":"CVE-2026-108474","title":"CVE-2026-108474 — In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQ","summary":"In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions","source":"NVD","date":"2026-10-10T00:17:03.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108474","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108474"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"cve@jetbrains.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108474"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108474"}],"epss":null},{"id":"CVE-2026-22061","title":"CVE-2026-22061 — Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authent","summary":"Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.","source":"NVD","date":"2026-10-09T23:16:54.157Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22061","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-22061"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-alert@netapp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-22061"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22061"}],"epss":null},{"id":"CVE-2026-18524","title":"CVE-2026-18524 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-09T23:16:54.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18524","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-18524"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-18524"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18524"}],"epss":null},{"id":"CVE-2026-16681","title":"CVE-2026-16681 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-09T23:16:54.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16681","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16681"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-16681"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16681"}],"epss":null},{"id":"CVE-2026-103755","title":"CVE-2026-103755 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-09T23:16:52.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103755","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103755"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-103755"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103755"}],"epss":null},{"id":"CVE-2026-108269","title":"CVE-2026-108269 — Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. ","summary":"Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing the clients to accept an attacker-terminated connection as the attested enclave. This issue is fixed in 0.5.0.","source":"NVD","date":"2026-10-09T22:16:59.793Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108269","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108269"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108269"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108269"}],"epss":null},{"id":"CVE-2026-108268","title":"CVE-2026-108268 — Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestat","summary":"Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.","source":"NVD","date":"2026-10-09T22:16:59.643Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108268","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108268"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108268"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108268"}],"epss":null},{"id":"CVE-2026-108267","title":"CVE-2026-108267 — Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. P","summary":"Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This issue is fixed in privasys-v0.5.1-go1.26.5.","source":"NVD","date":"2026-10-09T22:16:59.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108267","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108267"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108267"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108267"}],"epss":null},{"id":"CVE-2026-92705","title":"CVE-2026-92705 — Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Au","summary":"Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file executes arbitrary code with the privileges of the Aegisub process. From 3.4.0 to 3.4.2, inconsistent handling of embedded `NUL` characters between extension validation and filesystem operations additionally allows a crafted `ASS/Lua` polyglot to reference and execute itself as a single-file variant. The vulnerability is fixed in Aegisub 3.5.0.","source":"NVD","date":"2026-10-09T21:17:06.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92705","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92705"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-92705"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92705"}],"epss":null},{"id":"CVE-2026-62376","title":"CVE-2026-62376 — Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-re","summary":"Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. Version 2.4.0 fixes the issue.","source":"NVD","date":"2026-10-09T21:17:05.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62376","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62376","GHSA-R6W9-259G-GWRV"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62376","GHSA-r6w9-259g-gwrv"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62376"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r6w9-259g-gwrv"}],"epss":{"score":0.00215,"date":"2026-10-12","percentile":0.10885}},{"id":"CVE-2026-62367","title":"CVE-2026-62367 — Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an ","summary":"Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider `emailfallback` option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local (username+password) account using only the `email` claim from the IdP. The fallback never checks an `email_verified` (or Microsoft `xms_edov`) signal and never requires the matched account's password. An attacker who can obtain a token from the configured issuer carrying a victim's email logs in as that victim with a full session, with no consent or interaction from the victim. Version 2.4.0 fixes the issue.","source":"NVD","date":"2026-10-09T21:17:05.470Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62367","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62367","GHSA-XV7Q-FVMC-JX96"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62367","GHSA-xv7q-fvmc-jx96"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62367"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-xv7q-fvmc-jx96"}],"epss":{"score":0.00089,"date":"2026-10-12","percentile":0.00382}},{"id":"CVE-2026-57458","title":"CVE-2026-57458 — Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limi","summary":"Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API token's permissions, allowing access to routes outside its declared scope for the same user. Version 2.4.0 fixes the vulnerability.","source":"NVD","date":"2026-10-09T21:17:05.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57458","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-57458","GHSA-V3P6-34MC-HJ7V"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-57458","GHSA-v3p6-34mc-hj7v"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57458"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-v3p6-34mc-hj7v"}],"epss":{"score":0.00265,"date":"2026-10-12","percentile":0.17025}},{"id":"CVE-2026-108266","title":"CVE-2026-108266 — Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-bin","summary":"Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in privasys-v0.8.1.","source":"NVD","date":"2026-10-09T21:17:05.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108266","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108266"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108266"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108266"}],"epss":null},{"id":"CVE-2026-108265","title":"CVE-2026-108265 — Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to","summary":"Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in wasm-v0.40.0.","source":"NVD","date":"2026-10-09T21:17:04.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108265","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108265"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108265"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108265"}],"epss":null},{"id":"CVE-2026-108264","title":"CVE-2026-108264 — Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media ser","summary":"Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator importing an untrusted bundle through POST /settings/wizard/import, could execute arbitrary Python when GET /wizard/{server}/{idx} rendered the stored step; app/jinja_filters.py and app/services/wizard_widgets.py contained additional evaluation sinks. This could execute operating-system commands as the application user, disclose the Flask SECRET_KEY, access connected service credentials and the database, and produce stored cross-site scripting. T","source":"NVD","date":"2026-10-09T21:17:04.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108264","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108264"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108264"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108264"}],"epss":null},{"id":"CVE-2026-108263","title":"CVE-2026-108263 — Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the defa","summary":"Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the documented sandbox restrictions. An authenticated low-privilege tenant can execute code as root in the core-workflow container and use shared service and database credentials to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services. This issue is fixed in version 1.1.2.","source":"NVD","date":"2026-10-09T21:17:04.527Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108263","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108263"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108263"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108263"}],"epss":null},{"id":"CVE-2026-108261","title":"CVE-2026-108261 — Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* a","summary":"Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @t","source":"NVD","date":"2026-10-09T21:17:04.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108261","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108261","GHSA-X34J-47HF-4XG7"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108261","GHSA-x34j-47hf-4xg7"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108261"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x34j-47hf-4xg7"}],"epss":{"score":0.0016,"date":"2026-10-12","percentile":0.04551}},{"id":"CVE-2026-108260","title":"CVE-2026-108260 — Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tina","summary":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","source":"NVD","date":"2026-10-09T21:17:04.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108260","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108260","GHSA-C42Q-QVC3-J6VG"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108260","GHSA-c42q-qvc3-j6vg"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108260"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c42q-qvc3-j6vg"}],"epss":{"score":0.00205,"date":"2026-10-12","percentile":0.0962}},{"id":"CVE-2026-108259","title":"CVE-2026-108259 — Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from V","summary":"Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0.","source":"NVD","date":"2026-10-09T21:17:04.017Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108259","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108259","GHSA-PWHX-CVV3-QJ5C"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108259","GHSA-pwhx-cvv3-qj5c"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108259"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pwhx-cvv3-qj5c"}],"epss":{"score":0.00252,"date":"2026-10-12","percentile":0.15401}},{"id":"CVE-2026-108258","title":"CVE-2026-108258 — Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6","summary":"Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.","source":"NVD","date":"2026-10-09T21:17:03.853Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108258","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108258","GHSA-47C3-HPMG-7J6P"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108258","GHSA-47c3-hpmg-7j6p"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108258"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-47c3-hpmg-7j6p"}],"epss":{"score":0.00357,"date":"2026-10-12","percentile":0.27472}},{"id":"CVE-2026-107857","title":"CVE-2026-107857 — Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the m","summary":"Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.","source":"NVD","date":"2026-10-09T21:17:03.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107857","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107857"],"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107857"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107857"}],"epss":null},{"id":"CVE-2026-107856","title":"CVE-2026-107856 — CiviForm simplifies applications for government benefits programs by reusing applicant data across multip","summary":"CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.","source":"NVD","date":"2026-10-09T21:17:03.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107856","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107856"],"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107856"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107856"}],"epss":null},{"id":"CVE-2026-107854","title":"CVE-2026-107854 — Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /ap","summary":"Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the authenticated account. On installations with billing enabled, an authenticated user can renew or unsuspend another tenant's billable server when its renewal_date is non-null and more than seven days away, even without a subuser relationship to that server. This issue is fixed in version 4.0.5.","source":"NVD","date":"2026-10-09T21:17:03.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107854","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107854"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107854"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107854"}],"epss":null},{"id":"CVE-2026-107852","title":"CVE-2026-107852 — Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client","summary":"Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.","source":"NVD","date":"2026-10-09T21:17:03.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107852","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107852"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107852"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107852"}],"epss":null},{"id":"CVE-2026-107851","title":"CVE-2026-107851 — Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in c","summary":"Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by getDataSource(). If one request first checks a table allowed to the user and then a different denied table, the voter can reuse the allowed result, while DefaultDataContainerVoter can convert an incorrect abstention into a grant. A low-privileged backend user can consequently read, create, update, or delete records in tables outside assigned module permissions, including tables containing member or newsletter-subscriber data. This issue is fixed in version 5.7.12.","source":"NVD","date":"2026-10-09T21:17:02.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107851","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107851","GHSA-5974-GFQC-WRCM"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107851","GHSA-5974-gfqc-wrcm"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107851"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5974-gfqc-wrcm"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08266}},{"id":"CVE-2026-107850","title":"CVE-2026-107850 — Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers","summary":"Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\\CoreBundle\\Security\\Voter\\DataContainer\\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.","source":"NVD","date":"2026-10-09T21:17:02.770Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107850","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107850","GHSA-Q6WP-FR43-GM9V"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107850","GHSA-q6wp-fr43-gm9v"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107850"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-q6wp-fr43-gm9v"}],"epss":{"score":0.00193,"date":"2026-10-12","percentile":0.08266}},{"id":"CVE-2026-107848","title":"CVE-2026-107848 — Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates ","summary":"Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener validates REQUEST_TOKEN only for POST requests, while the declarative GET guard runs only when an act parameter is present. Backend actions dispatched through the key parameter can therefore execute without a CSRF token when an authenticated backend user loads an attacker-controlled URL. Reachable actions remain limited to modules available to that user, and the advisory demonstrates destructive or state-changing actions rather than privilege escalation. This issue is fixed in versions 5.3.50 and 5.7.12.","source":"NVD","date":"2026-10-09T21:17:02.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107848","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107848","GHSA-9FF2-P842-45WQ"],"cvss":{"score":3.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107848","GHSA-9ff2-p842-45wq"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107848"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9ff2-p842-45wq"}],"epss":{"score":0.00113,"date":"2026-10-12","percentile":0.0134}},{"id":"https://www.securityweek.com/?p=49922","title":"OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks","source":"SecurityWeek","date":"2026-10-09T21:07:46.000Z","summary":"” The post OpenAI Fires 3 Safety Researchers in Dispute Over AI Risks appeared first on SecurityWeek . Read the original report for details.","url":"https://www.securityweek.com/openai-fires-3-safety-researchers-in-dispute-over-ai-risks/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49922"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/openai-fires-3-safety-researchers-in-dispute-over-ai-risks/"}],"epss":null},{"id":"GHSA-M687-P538-R5HP","title":"Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted","source":"GitHub Advisories","date":"2026-10-09T20:57:50Z","summary":"1:*` and `http://localhost:*`, and sends `Access-Control-Allow-Credentials: true`, so a page served from any port on the user's own machine may make credentialed cross-origin requests to the API and read the responses.  publicurl` is appended to that default list rather than replacing it, so a fully configured production deployment still trusts every localhost origin.","url":"https://github.com/advisories/GHSA-m687-p538-r5hp","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-M687-P538-R5HP"],"kev":false,"recordIds":["GHSA-m687-p538-r5hp"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-m687-p538-r5hp"}],"epss":null},{"id":"GHSA-FMMF-XQ98-G327","title":"Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check","source":"GitHub Advisories","date":"2026-10-09T20:57:47Z","summary":"## Summary A project member with Write permission can delete an admin-tier link share on that project.  The deletion authorization check reads the permission from an object populated only with URL IDs, rather than from the stored share.","url":"https://github.com/advisories/GHSA-fmmf-xq98-g327","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-FMMF-XQ98-G327"],"kev":false,"recordIds":["GHSA-fmmf-xq98-g327"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fmmf-xq98-g327"}],"epss":null},{"id":"GHSA-PJR3-86V4-5P7W","title":"Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)","source":"GitHub Advisories","date":"2026-10-09T20:57:44Z","summary":"0 the project-permission engine resolves a user's effective permission on a project as the **MAX over the entire reachable project subtree**.  As a result, when a user has been granted a **higher** permission on a parent project and the owner *explicitly* shares a **child** project with that same user at a **lower** permission (an intended down-restriction), the explicit lower grant is **silently ignored** and the user receives the higher, inherited permission on the child.","url":"https://github.com/advisories/GHSA-pjr3-86v4-5p7w","topic":"Code & supply chain","read":false,"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-PJR3-86V4-5P7W"],"kev":false,"recordIds":["GHSA-pjr3-86v4-5p7w"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pjr3-86v4-5p7w"}],"epss":null},{"id":"GHSA-HJX8-QV73-F7CM","title":"Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed","source":"GitHub Advisories","date":"2026-10-09T20:57:41Z","summary":"## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because nothing on any revocation path deletes the webhook they created while they had access.  Vikunja already has a revocation-cleanup routine that deletes other derived rows for exactly this reason.","url":"https://github.com/advisories/GHSA-hjx8-qv73-f7cm","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["GHSA-HJX8-QV73-F7CM"],"kev":false,"recordIds":["GHSA-hjx8-qv73-f7cm"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-hjx8-qv73-f7cm"}],"epss":null},{"id":"GHSA-FPRF-R6RV-XG99","title":"Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants","source":"GitHub Advisories","date":"2026-10-09T20:57:38Z","summary":"0 the task position recalculation that runs when a saved filter view is created fails open when the requesting user has no accessible projects.  Instead of aborting, the search that feeds the recalculation loses its project scope entirely and returns every task in the instance.","url":"https://github.com/advisories/GHSA-fprf-r6rv-xg99","topic":"Code & supply chain","read":false,"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"GitHub Advisories"},"aliases":["GHSA-FPRF-R6RV-XG99"],"kev":false,"recordIds":["GHSA-fprf-r6rv-xg99"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fprf-r6rv-xg99"}],"epss":null},{"id":"GHSA-4HV6-XC92-J86G","title":"Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes","source":"GitHub Advisories","date":"2026-10-09T20:57:34Z","summary":"0 introduced server-side sessions with revocation semantics: `DELETE /api/v2/user/sessions/{id}` documents \"Revokes a specific session by its UUID\", and enabling TOTP calls `DeleteAllUserSessions` to invalidate all sessions.  The WebSocket endpoint accepts any cryptographically valid user JWT without ever resolving its `sid` (session id) claim against the sessions table.","url":"https://github.com/advisories/GHSA-4hv6-xc92-j86g","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["GHSA-4HV6-XC92-J86G"],"kev":false,"recordIds":["GHSA-4hv6-xc92-j86g"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4hv6-xc92-j86g"}],"epss":null},{"id":"CVE-2026-107805","title":"Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage","source":"GitHub Advisories","date":"2026-10-09T20:57:08Z","summary":"x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature.  An unauthenticated remote client that can reach the API can provide syntactically valid signature metadata and cause storage and I/O consumption before the request is rejected.","url":"https://github.com/advisories/GHSA-j3hg-9rp3-5hw9","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107805","GHSA-J3HG-9RP3-5HW9"],"kev":false,"recordIds":["GHSA-j3hg-9rp3-5hw9","CVE-2026-107805"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-j3hg-9rp3-5hw9"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107805"}],"epss":{"score":0.00443,"date":"2026-10-12","percentile":0.36633}},{"id":"CVE-2026-107804","title":"Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout","source":"GitHub Advisories","date":"2026-10-09T20:57:05Z","summary":"x, the official bundled reverse-proxy topology did not preserve the external client identity used by Gin.  The backend treated the local proxy peer as the client because no trusted proxy was configured, while the proxy supplied the actual address in forwarding headers.","url":"https://github.com/advisories/GHSA-9h23-53f4-q947","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-107804","GHSA-9H23-53F4-Q947"],"kev":false,"recordIds":["GHSA-9h23-53f4-q947","CVE-2026-107804"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9h23-53f4-q947"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107804"}],"epss":{"score":0.0022,"date":"2026-10-12","percentile":0.11548}},{"id":"GHSA-W2CH-4XGR-22WW","title":"Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal","source":"GitHub Advisories","date":"2026-10-09T20:54:52Z","summary":"## Summary Deleting a task relation only requires write access on the base task.  Unlike relation creation, it does not verify that the caller can read the other task.","url":"https://github.com/advisories/GHSA-w2ch-4xgr-22ww","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-W2CH-4XGR-22WW"],"kev":false,"recordIds":["GHSA-w2ch-4xgr-22ww"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w2ch-4xgr-22ww"}],"epss":null},{"id":"GHSA-8WVG-R2J4-3737","title":"Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint","source":"GitHub Advisories","date":"2026-10-09T20:54:49Z","summary":"ReadAll` returns assignee user objects without blanking the `Email` field, disclosing assignee email addresses to any read-only project member.  Every sibling path that returns user objects obfuscates the email; this one does not.","url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-8WVG-R2J4-3737"],"kev":false,"recordIds":["GHSA-8wvg-r2j4-3737"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8wvg-r2j4-3737"}],"epss":null},{"id":"GHSA-3HC7-R24J-RPWC","title":"Vikunja: Cross-project task disclosure through subtask expansion","source":"GitHub Advisories","date":"2026-10-09T20:54:46Z","summary":"### Summary Vikunja lets a task in one project have a subtask that lives in a different project.  expand%5B%5D=subtasks).","url":"https://github.com/advisories/GHSA-3hc7-r24j-rpwc","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-3HC7-R24J-RPWC"],"kev":false,"recordIds":["GHSA-3hc7-r24j-rpwc"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3hc7-r24j-rpwc"}],"epss":null},{"id":"GHSA-G38J-7V97-X298","title":"Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID","source":"GitHub Advisories","date":"2026-10-09T20:54:43Z","summary":"CanCreate` permission check that the REST API enforces.  An attacker can attach a relation to any task whose UID they know, including tasks in projects they have no access to.","url":"https://github.com/advisories/GHSA-g38j-7v97-x298","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-G38J-7V97-X298"],"kev":false,"recordIds":["GHSA-g38j-7v97-x298"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-g38j-7v97-x298"}],"epss":null},{"id":"CVE-2026-107842","title":"Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled","source":"GitHub Advisories","date":"2026-10-09T20:54:09Z","summary":"index_protected`, but the authorisation data lives per row in `tl_search`.  Turning the setting off removes the filter without removing the rows, so protected pages that were indexed while it was on are returned to unauthenticated visitors such as title, URL and context snippet, even though the pages themselves still answer 401.","url":"https://github.com/advisories/GHSA-x2rp-9qf7-2fmq","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107842","GHSA-X2RP-9QF7-2FMQ"],"kev":false,"recordIds":["GHSA-x2rp-9qf7-2fmq","CVE-2026-107842"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x2rp-9qf7-2fmq"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107842"}],"epss":{"score":0.00262,"date":"2026-10-12","percentile":0.16667}},{"id":"CVE-2026-107843","title":"Contao: The registration module re-sends activation mails","source":"GitHub Advisories","date":"2026-10-09T20:54:04Z","summary":"`ModuleRegistration::compile()` reaches its follow-up registration branch on **any** POST to a page carrying the module.  That branch checks neither `FORM_SUBMIT` nor the captcha result computed immediately above it, and `resendActivationMail()` leads to `OptInToken::send()`, which has no rate limit at all.","url":"https://github.com/advisories/GHSA-mfxh-vp55-7gc6","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107843","GHSA-MFXH-VP55-7GC6"],"kev":false,"recordIds":["GHSA-mfxh-vp55-7gc6","CVE-2026-107843"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mfxh-vp55-7gc6"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107843"}],"epss":{"score":0.00255,"date":"2026-10-12","percentile":0.15826}},{"id":"CVE-2026-107844","title":"Contao: Path traversal in the images controller","source":"GitHub Advisories","date":"2026-10-09T20:53:55Z","summary":"` segments, and never calls `Path::isBasePath()` to confirm the result stayed inside that directory.  An unauthenticated GET with percent encoded dot segments therefore escapes the directory and the file is returned by `BinaryFileResponse`.","url":"https://github.com/advisories/GHSA-mrvp-7wmx-5m4h","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107844","GHSA-MRVP-7WMX-5M4H"],"kev":false,"recordIds":["GHSA-mrvp-7wmx-5m4h","CVE-2026-107844"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mrvp-7wmx-5m4h"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107844"}],"epss":{"score":0.00312,"date":"2026-10-12","percentile":0.22232}},{"id":"CVE-2026-107845","title":"Contao: Cross-site scripting in the comments bundle","source":"GitHub Advisories","date":"2026-10-09T20:53:50Z","summary":"An unauthenticated front end visitor can post a comment containing a XSS injection.  The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it.","url":"https://github.com/advisories/GHSA-628f-v4f6-p37r","topic":"Code & supply chain","read":false,"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107845","GHSA-628F-V4F6-P37R"],"kev":false,"recordIds":["GHSA-628f-v4f6-p37r","CVE-2026-107845"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-628f-v4f6-p37r"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107845"}],"epss":{"score":0.00272,"date":"2026-10-12","percentile":0.18029}},{"id":"CVE-2026-91970","title":"Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API","source":"GitHub Advisories","date":"2026-10-09T20:53:24Z","summary":"# Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API ## Summary The always-registered Planka migration lets any ordinary user select a Planka server.  Although Vikunja caps each JSON response, pagination loop, and attachment independently, it has no aggregate job budget.","url":"https://github.com/advisories/GHSA-wq92-8x3r-fm38","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91970","GHSA-WQ92-8X3R-FM38"],"kev":false,"recordIds":["GHSA-wq92-8x3r-fm38"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-wq92-8x3r-fm38"}],"epss":{"score":0.00378,"date":"2026-10-12","percentile":0.29836}},{"id":"CVE-2026-91969","title":"Vikunja: Unbounded CSV row cardinality permits API process termination","source":"GitHub Advisories","date":"2026-10-09T20:53:14Z","summary":"# Unbounded CSV row cardinality permits API process termination ## Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality.  It reads every record into a [][]string and then materializes a full task object for every row before insertion.","url":"https://github.com/advisories/GHSA-pqf9-h8g4-8gmh","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91969","GHSA-PQF9-H8G4-8GMH"],"kev":false,"recordIds":["GHSA-pqf9-h8g4-8gmh"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pqf9-h8g4-8gmh"}],"epss":{"score":0.00348,"date":"2026-10-12","percentile":0.26427}},{"id":"CVE-2026-91968","title":"Vikunja: Unbounded nested task-filter recursion permits API process termination","source":"GitHub Advisories","date":"2026-10-09T20:53:03Z","summary":"# Unbounded nested task-filter recursion permits API process termination ## Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree.  A syntactically valid deeply nested expression well below the HTTP request-size ceiling exhausts memory and kills the API process.","url":"https://github.com/advisories/GHSA-xxc3-xpmc-vmvr","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91968","GHSA-XXC3-XPMC-VMVR"],"kev":false,"recordIds":["GHSA-xxc3-xpmc-vmvr"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-xxc3-xpmc-vmvr"}],"epss":{"score":0.00436,"date":"2026-10-12","percentile":0.35978}},{"id":"CVE-2026-91979","title":"Vikunja: Denial of service via decompression bomb in the data import","source":"GitHub Advisories","date":"2026-10-09T20:52:52Z","summary":"### Summary Vikunja lets you export your data as a zip and import it back.  The import doesn't limit how large the archive expands to, how many files it contains, or how much storage one user can consume, and it appears to hold the whole archive in memory while processing it.","url":"https://github.com/advisories/GHSA-w7jp-mf2v-8342","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91979","GHSA-W7JP-MF2V-8342"],"kev":false,"recordIds":["GHSA-w7jp-mf2v-8342"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w7jp-mf2v-8342"}],"epss":{"score":0.00436,"date":"2026-10-12","percentile":0.35979}},{"id":"CVE-2026-91981","title":"Vikunja: Link-share token can enumerate users through the v2 API","source":"GitHub Advisories","date":"2026-10-09T20:52:39Z","summary":"### Summary A link-share token, the credential you hand out to let someone view a shared project, can call the v2 user-search endpoints, which it was never meant to reach.  The v1 versions of the same endpoints correctly reject link-share tokens; the v2 versions don't.","url":"https://github.com/advisories/GHSA-vfxw-3x8p-2vjr","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91981","GHSA-VFXW-3X8P-2VJR"],"kev":false,"recordIds":["GHSA-vfxw-3x8p-2vjr"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-vfxw-3x8p-2vjr"}],"epss":{"score":0.00306,"date":"2026-10-12","percentile":0.21613}},{"id":"CVE-2026-91980","title":"Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project","source":"GitHub Advisories","date":"2026-10-09T20:52:27Z","summary":"### Summary When you share a project with a team, the API lets you attach any team on the instance, including teams you have nothing to do with, as long as you're an admin of the project.  Listing a project's teams then returns each team's full member roster.","url":"https://github.com/advisories/GHSA-39p5-2wrr-xh29","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91980","GHSA-39P5-2WRR-XH29"],"kev":false,"recordIds":["GHSA-39p5-2wrr-xh29"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-39p5-2wrr-xh29"}],"epss":{"score":0.00306,"date":"2026-10-12","percentile":0.21612}},{"id":"CVE-2026-91971","title":"Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification","source":"GitHub Advisories","date":"2026-10-09T20:52:15Z","summary":"### Summary The 50-megapixel decode guard exists only on the task-attachment preview path.  Avatar and project-background uploads decode uploaded images with no pixel cap.","url":"https://github.com/advisories/GHSA-4vh2-39rq-rq8j","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91971","GHSA-4VH2-39RQ-RQ8J"],"kev":false,"recordIds":["GHSA-4vh2-39rq-rq8j"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4vh2-39rq-rq8j"}],"epss":{"score":0.00436,"date":"2026-10-12","percentile":0.35978}},{"id":"CVE-2026-91973","title":"Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords","source":"GitHub Advisories","date":"2026-10-09T20:52:04Z","summary":"well-known`, and `/feeds` groups are registered on the root Echo instance with only BasicAuth and no rate limiter.  CalDAV BasicAuth accepts the plain account password, so password guessing over `/dav` is unbounded and never returns 429, while `/api/v1/login` is throttled from the tenth attempt.","url":"https://github.com/advisories/GHSA-m469-88xx-8rx2","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91973","GHSA-M469-88XX-8RX2"],"kev":false,"recordIds":["GHSA-m469-88xx-8rx2"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-m469-88xx-8rx2"}],"epss":{"score":0.00672,"date":"2026-10-12","percentile":0.50706}},{"id":"CVE-2026-91983","title":"Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)","source":"GitHub Advisories","date":"2026-10-09T20:51:52Z","summary":"## Summary API token permission checks only match the HTTP method and route path.  The `expand` query parameter on task read endpoints embeds data from other permission groups (task comments, reactions, time entry counts) without checking whether the token holds those scopes.","url":"https://github.com/advisories/GHSA-9rg3-v78m-26q8","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91983","GHSA-9RG3-V78M-26Q8"],"kev":false,"recordIds":["GHSA-9rg3-v78m-26q8"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9rg3-v78m-26q8"}],"epss":{"score":0.00305,"date":"2026-10-12","percentile":0.21458}},{"id":"CVE-2026-91984","title":"Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)","source":"GitHub Advisories","date":"2026-10-09T20:51:41Z","summary":"CanUpdate` (write access to the task's own project) and the request body's `project_view_id` is never validated to belong to the task's project, nor is any access to that view required.  Any authenticated user with a single writable task of their own can persist `(task_id, project_view_id, position)` rows into any other tenant's project view (view IDs are small sequential integers and enumerable).","url":"https://github.com/advisories/GHSA-w39f-h553-h2mx","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91984","GHSA-W39F-H553-H2MX"],"kev":false,"recordIds":["GHSA-w39f-h553-h2mx"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w39f-h553-h2mx"}],"epss":{"score":0.00264,"date":"2026-10-12","percentile":0.16914}},{"id":"CVE-2026-91985","title":"Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level","source":"GitHub Advisories","date":"2026-10-09T20:51:29Z","summary":"## Summary A user who has only read permission on a project can call the single link-share read endpoint and receive the share's `hash` field — the secret credential that the anonymous `POST /shares/{share}/auth` endpoint exchanges for a link-share JWT carrying the share's permission (read / read-write / admin).  A read-only member can therefore mint a write- or admin-level token for the project and perform writes they are not entitled to, while their own user token is correctly refused.","url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91985","GHSA-QFWC-VX6F-3G6G"],"kev":false,"recordIds":["GHSA-qfwc-vx6f-3g6g"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-qfwc-vx6f-3g6g"}],"epss":{"score":0.00432,"date":"2026-10-12","percentile":0.35642}},{"id":"CVE-2026-91982","title":"Vikunja: TOTP secret is readable after enrollment, no step-up auth","source":"GitHub Advisories","date":"2026-10-09T20:51:17Z","summary":"### Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account's access token.  Reading it doesn't ask for the password, even though disabling TOTP does.","url":"https://github.com/advisories/GHSA-88f6-4rjv-x774","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91982","GHSA-88F6-4RJV-X774"],"kev":false,"recordIds":["GHSA-88f6-4rjv-x774"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-88f6-4rjv-x774"}],"epss":{"score":0.00346,"date":"2026-10-12","percentile":0.26173}},{"id":"CVE-2026-91972","title":"Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited","source":"GitHub Advisories","date":"2026-10-09T20:51:05Z","summary":"enabled` is false (the default).  So on a stock install every v2 pre-auth endpoint (login, register, password-reset token, oauth token) is unthrottled, while its v1 twin is throttled.","url":"https://github.com/advisories/GHSA-6rvj-qwjf-3m4q","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-91972","GHSA-6RVJ-QWJF-3M4Q"],"kev":false,"recordIds":["GHSA-6rvj-qwjf-3m4q"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6rvj-qwjf-3m4q"}],"epss":{"score":0.00633,"date":"2026-10-12","percentile":0.48896}},{"id":"CVE-2026-107806","title":"Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","source":"GitHub Advisories","date":"2026-10-09T20:45:02Z","summary":"ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`.  11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`.","url":"https://github.com/advisories/GHSA-p393-cf76-4jmr","topic":"Code & supply chain","read":false,"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107806","GHSA-P393-CF76-4JMR"],"kev":false,"recordIds":["GHSA-p393-cf76-4jmr","CVE-2026-107806"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p393-cf76-4jmr"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107806"}],"epss":{"score":0.00333,"date":"2026-10-12","percentile":0.24655}},{"id":"CVE-2026-107839","title":"ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service","source":"GitHub Advisories","date":"2026-10-09T20:44:54Z","summary":"Data))`), with no request body size limit and no cap on the number of array elements anywhere in the request path.  Because the default configuration ships with `Authentication = 'disabled'`, any network client can obtain a session through unauthenticated platform login and then send a single crafted request that forces the server to allocate memory proportional to attacker-chosen input.","url":"https://github.com/advisories/GHSA-4jfq-pmq9-257h","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107839","GHSA-4JFQ-PMQ9-257H"],"kev":false,"recordIds":["GHSA-4jfq-pmq9-257h","CVE-2026-107839"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4jfq-pmq9-257h"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107839"}],"epss":{"score":0.00342,"date":"2026-10-12","percentile":0.25715}},{"id":"CVE-2026-76216","title":"Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure","source":"GitHub Advisories","date":"2026-10-09T20:43:40Z","summary":"LinkSharing`.  id`.","url":"https://github.com/advisories/GHSA-32r8-5843-4qw2","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-76216","GHSA-32R8-5843-4QW2"],"kev":false,"recordIds":["GHSA-32r8-5843-4qw2"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-32r8-5843-4qw2"}],"epss":{"score":0.00363,"date":"2026-10-12","percentile":0.28173}},{"id":"CVE-2026-107840","title":"yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels","source":"GitHub Advisories","date":"2026-10-09T20:42:58Z","summary":"Method directly as a label value on request counter and duration histogram metrics.  g.","url":"https://github.com/advisories/GHSA-6r69-c6wg-7g8m","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107840","GHSA-6R69-C6WG-7G8M"],"kev":false,"recordIds":["GHSA-6r69-c6wg-7g8m","CVE-2026-107840"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6r69-c6wg-7g8m"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107840"}],"epss":{"score":0.00444,"date":"2026-10-12","percentile":0.36789}},{"id":"CVE-2026-107841","title":"pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents","source":"GitHub Advisories","date":"2026-10-09T20:42:51Z","summary":"require_consent` may submit or cancel a document.  Because ERPNext performs further document writes as a consequence of a governed act, nested acts are allowed to \"ride\" the consent established by the enclosing act instead of needing a marker of their own.","url":"https://github.com/advisories/GHSA-3hj7-6vmj-h8v4","topic":"Code & supply chain","read":false,"cvss":{"score":5.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107841","GHSA-3HJ7-6VMJ-H8V4"],"kev":false,"recordIds":["GHSA-3hj7-6vmj-h8v4","CVE-2026-107841"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3hj7-6vmj-h8v4"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107841"}],"epss":{"score":0.00233,"date":"2026-10-12","percentile":0.1303}},{"id":"CVE-2026-68582","title":"Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)","source":"GitHub Advisories","date":"2026-10-09T20:42:33Z","summary":"## Summary The task-collection endpoint `GET /api/v1/projects/{project}/views/{view}/tasks` loads the requested project view straight from the URL path without verifying the caller is authorized for it.  For a **link-share token**, the task query is correctly pinned to the share's own project, but the *view* is taken from the attacker-controlled path and never re-validated against the share.","url":"https://github.com/advisories/GHSA-rj9j-8772-4h6c","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-68582","GHSA-RJ9J-8772-4H6C"],"kev":false,"recordIds":["GHSA-rj9j-8772-4h6c"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-rj9j-8772-4h6c"}],"epss":{"score":0.00267,"date":"2026-10-12","percentile":0.17329}},{"id":"CVE-2026-68581","title":"Vikunja: Link-share principal ID collision allows cross-account API token issuance and management","source":"GitHub Advisories","date":"2026-10-09T20:42:14Z","summary":"Executive Summary Vikunja accepts both regular-user JSON Web Tokens (JWTs) and link-share JWTs through its generic authenticated API route group.  id`.","url":"https://github.com/advisories/GHSA-vvcv-vpph-h844","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-68581","GHSA-VVCV-VPPH-H844"],"kev":false,"recordIds":["GHSA-vvcv-vpph-h844"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-vvcv-vpph-h844"}],"epss":{"score":0.00464,"date":"2026-10-12","percentile":0.38348}},{"id":"CVE-2026-78797","title":"CVE-2026-78797 — An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via t","summary":"An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.","source":"NVD","date":"2026-10-09T20:17:11.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78797","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78797"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-78797"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78797"}],"epss":null},{"id":"CVE-2026-104758","title":"CVE-2026-104758 — Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-73364. Reason: This ","summary":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-73364. Reason: This candidate is a reservation duplicate of CVE-2026-73364. Notes: All CVE users should reference CVE-2026-73364 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","source":"NVD","date":"2026-10-09T20:17:09.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104758","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104758"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-104758"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104758"}],"epss":null},{"id":"CVE-2025-8457","title":"CVE-2025-8457 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-09T20:17:08.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8457","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-8457"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2025-8457"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8457"}],"epss":null},{"id":"CVE-2026-78835","title":"CVE-2026-78835 — Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.","summary":"Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.","source":"NVD","date":"2026-10-09T19:16:42.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78835","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78835"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-78835"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78835"}],"epss":null},{"id":"CVE-2026-75353","title":"CVE-2026-75353 — OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen co","summary":"OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service","source":"NVD","date":"2026-10-09T19:16:42.297Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75353","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75353"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-75353"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75353"}],"epss":null},{"id":"CVE-2026-75352","title":"CVE-2026-75352 — OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen conn","summary":"OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service","source":"NVD","date":"2026-10-09T19:16:42.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75352","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75352"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-75352"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75352"}],"epss":null},{"id":"CVE-2026-75351","title":"CVE-2026-75351 — OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen con","summary":"OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.","source":"NVD","date":"2026-10-09T19:16:42.047Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75351","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75351"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-75351"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75351"}],"epss":null},{"id":"https://thehackernews.com/2026/10/credential-stealing-github-actions.html","title":"Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories","source":"The Hacker News","date":"2026-10-09T19:14:28.000Z","summary":"Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories.  \"Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC,\" StepSecurity","url":"https://thehackernews.com/2026/10/credential-stealing-github-actions.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/credential-stealing-github-actions.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/credential-stealing-github-actions.html"}],"epss":null},{"id":"CVE-2026-75350","title":"CVE-2026-75350 — EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() im","summary":"EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service","source":"NVD","date":"2026-10-09T18:17:14.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75350","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75350"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-75350"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75350"}],"epss":null},{"id":"CVE-2026-108096","title":"CVE-2026-108096 — Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS ","summary":"Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries.\n\n\n\nThis issue has been addressed in @aws-amplify/graphql-index-transformer  3.1.2 https://www.npmjs.com/package/@aws-amplify/graphql-index-transformer/v/3.1.2  (included in @aws-amplify/data-construct  1.17.4 https://www.npmjs.com/package/@aws-amplify/data-construct/v/1.17.4  and @aws-amplify/graphql-api-construct  1.21.4 https://www.npmjs.com/package/@aws-amplify/graphql-api-construct/v/1.21.4 ). We recommend upgrading to the latest version ensuring any forked or derivative code is patched to incorporate the new fixes and then redeploying their backend.","source":"NVD","date":"2026-10-09T18:17:06.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108096","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108096"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},"read":false,"kev":false,"recordIds":["CVE-2026-108096"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108096"}],"epss":null},{"id":"CVE-2026-107838","title":"CVE-2026-107838 — RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a sufficiently large extended token when nanocoap_token_ext is enabled, causing response initialization to fail while _get_file() or _get_directory() continues with stale response state. The path then reaches _calc_szx2() and its pdu->payload_len > reserve assertion, terminating the affected service or device task. No fixed release is available as of this review.","source":"NVD","date":"2026-10-09T18:17:05.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107838","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107838"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107838"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107838"}],"epss":null},{"id":"CVE-2026-107837","title":"CVE-2026-107837 — RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header without verifying that the packet snip contains the required bytes. A remote attacker can send a malformed 6LoWPAN fragment that causes gnrc_sixlowpan_frag_recv() to read beyond the packet buffer, potentially disclosing memory and crashing the network stack. No fixed repository release is available as of this review.","source":"NVD","date":"2026-10-09T18:17:05.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107837","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107837"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107837"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107837"}],"epss":null},{"id":"CVE-2026-107836","title":"CVE-2026-107836 — RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other","summary":"RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, the nanoCoAP client function nanocoap_sock_get_slice() in sys/net/application_layer/nanocoap/sock.c accepts a Block2 response when _block_cb() sees the expected block number without also verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing the derived offset to exceed the client slice offset and making ctx->offset - offset underflow in _2buf_slice(). The resulting buffer-relative calculation can read before the payload buffer and crash the client, causing denial of service and potentially exposing adjacent memory. No fixed release is available as of this rev","source":"NVD","date":"2026-10-09T18:17:05.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107836","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107836"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107836"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107836"}],"epss":null},{"id":"CVE-2026-107835","title":"CVE-2026-107835 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, int","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in internal/cookies/cookies.go handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. Exploitation depends on the backend parser and affected rule scope, and interior control characters with inconsistent backend behavior are outside this advisory's remediation. This issue is fixed in version 3.8.1.","source":"NVD","date":"2026-10-09T18:17:05.157Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107835","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107835"],"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107835"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107835"}],"epss":null},{"id":"CVE-2026-107834","title":"CVE-2026-107834 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-09T18:17:05.007Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107834","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107834"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107834"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107834"}],"epss":null},{"id":"CVE-2026-107833","title":"CVE-2026-107833 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. Request JSON processing is not affected by this specific path because it uses the configured request recursion limit, and exploitation requires response-body inspection to be enabled. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-09T18:17:04.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107833","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107833"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107833"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107833"}],"epss":null},{"id":"CVE-2026-107826","title":"CVE-2026-107826 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail that was not visited by the bounded walk, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with an unrecoverable fatal stack overflow. The ProcessRequest and ProcessResponse JSON paths share the affected readJSON validation flow, and the payload can remain within recommended body-size and argument-count limits. This issue is fixed in version 3.8.1.","source":"NVD","date":"2026-10-09T18:17:04.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107826"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107826"}],"epss":null},{"id":"CVE-2026-107825","title":"CVE-2026-107825 — OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.","summary":"OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. The bundled coraza/v3/http integration is not affected because Go net/http rejects such malformed request targets before calling Coraza. This issue is fixed in version 3.8.0.","source":"NVD","date":"2026-10-09T18:17:04.503Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107825","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107825"],"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107825"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107825"}],"epss":null},{"id":"CVE-2026-107824","title":"CVE-2026-107824 — x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's ","summary":"x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port, 9094 for x64 or 9095 for x32, can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.","source":"NVD","date":"2026-10-09T18:17:04.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107824","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107824"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107824"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107824"}],"epss":null},{"id":"CVE-2026-107823","title":"CVE-2026-107823 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:04.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107823"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107823"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823"}],"epss":null},{"id":"CVE-2026-107822","title":"CVE-2026-107822 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:04.030Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107822"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107822"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822"}],"epss":null},{"id":"CVE-2026-107821","title":"CVE-2026-107821 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:03.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107821"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107821"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821"}],"epss":null},{"id":"CVE-2026-107820","title":"CVE-2026-107820 — x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's ","summary":"x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in unchecked usize addition in wsRecv() before token authentication. The server listens on 0.0.0.0 by default in affected versions. An unauthenticated network client can supply a near-maximum Content-Length value to trigger a runtime integer-overflow panic in Debug and ReleaseSafe builds, terminating the entire x64dbg process and its live debugging session. The overflowed value is used only in a comparison, so the impact is limited to denial of service rather than memory corruption or code execution. This issue is fixed in version 1.2.","source":"NVD","date":"2026-10-09T18:17:03.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107820","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107820"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107820"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107820"}],"epss":null},{"id":"CVE-2026-107819","title":"CVE-2026-107819 — MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databa","summary":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10.","source":"NVD","date":"2026-10-09T18:17:03.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107819"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107819"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819"}],"epss":null},{"id":"CVE-2026-107818","title":"CVE-2026-107818 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:03.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107818"],"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107818"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818"}],"epss":null},{"id":"CVE-2026-107817","title":"CVE-2026-107817 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mysql_json plugin assumed that imported MySQL tables contained valid MySQL binary JSON data. A specially prepared MySQL table containing invalid JSON data could cause out-of-bounds reads, information disclosure, or a server crash. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:03.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107817","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107817"],"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107817"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107817"}],"epss":null},{"id":"CVE-2026-107816","title":"CVE-2026-107816 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T18:17:03.060Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107816"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107816"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816"}],"epss":null},{"id":"https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html","title":"FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack","source":"The Hacker News","date":"2026-10-09T17:45:26.000Z","summary":"The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a&nbsp;post on X.  ShinyHunters is the extortion group that said in September it had&nbsp;breached the FBI's jobs portal&nbsp;and stolen sensitive data on almost all FBI agents and job applicants.","url":"https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html"}],"epss":null},{"id":"CVE-2026-75597","title":"CVE-2026-75597 — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<","summary":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.","source":"NVD","date":"2026-10-09T17:16:48.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75597","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75597","GHSA-J92P-C242-7HFX"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75597","GHSA-j92p-c242-7hfx"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75597"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-j92p-c242-7hfx"}],"epss":{"score":0.00296,"date":"2026-10-12","percentile":0.20536}},{"id":"CVE-2026-75347","title":"CVE-2026-75347 — EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerab","summary":"EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.","source":"NVD","date":"2026-10-09T17:16:48.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75347","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75347"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-75347"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75347"}],"epss":null},{"id":"CVE-2026-55797","title":"CVE-2026-55797 — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.1","summary":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand that is executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can supply a crafted proxy host to execute commands in the repo-server and access its Git, Helm, and OCI credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.","source":"NVD","date":"2026-10-09T17:16:47.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55797","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-55797","GHSA-J6CW-G6P4-7HCH"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-55797","GHSA-j6cw-g6p4-7hch"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55797"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-j6cw-g6p4-7hch"}],"epss":{"score":0.01548,"date":"2026-10-12","percentile":0.74365}},{"id":"CVE-2026-48484","title":"CVE-2026-48484 — pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rp","summary":"pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memory with `file.read()`. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file upload can exhaust the server's available memory which led to process termination. Version 0.5.0b3.dev101 contains a patch.","source":"NVD","date":"2026-10-09T17:16:47.487Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48484","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-48484","GHSA-VQ8P-M3WM-GV5F"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-48484","GHSA-vq8p-m3wm-gv5f"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48484"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-vq8p-m3wm-gv5f"}],"epss":{"score":0.00312,"date":"2026-10-12","percentile":0.2225}},{"id":"CVE-2026-108160","title":"CVE-2026-108160 — AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows net","summary":"AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.","source":"NVD","date":"2026-10-09T17:16:47.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108160","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108160"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108160"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108160"}],"epss":null},{"id":"CVE-2026-108159","title":"CVE-2026-108159 — AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-compo","summary":"AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user.","source":"NVD","date":"2026-10-09T17:16:47.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108159","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108159"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108159"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108159"}],"epss":null},{"id":"CVE-2026-108158","title":"CVE-2026-108158 — plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpo","summary":"plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/.","source":"NVD","date":"2026-10-09T17:16:46.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108158","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108158"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108158"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108158"}],"epss":null},{"id":"CVE-2026-108157","title":"CVE-2026-108157 — Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows r","summary":"Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.","source":"NVD","date":"2026-10-09T17:16:46.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108157","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108157"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108157"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108157"}],"epss":null},{"id":"CVE-2026-108156","title":"CVE-2026-108156 — LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skil","summary":"LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's _meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation recursively delete arbitrary user-writable directories, such as the home directory, since the security scanner never inspects _meta.json.","source":"NVD","date":"2026-10-09T17:16:46.540Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108156","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108156"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108156"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108156"}],"epss":null},{"id":"CVE-2026-108119","title":"CVE-2026-108119 — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink en","summary":"A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.","source":"NVD","date":"2026-10-09T17:16:46.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108119","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108119"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108119"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108119"}],"epss":null},{"id":"CVE-2026-108093","title":"CVE-2026-108093 — A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc paras","summary":"A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specially crafted XCF file with a zero-size simulation parasite can cause a NULL pointer dereference and crash the GIMP application.","source":"NVD","date":"2026-10-09T17:16:46.260Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108093","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108093"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108093"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108093"}],"epss":null},{"id":"CVE-2026-107815","title":"CVE-2026-107815 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T17:16:45.970Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107815"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107815"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815"}],"epss":null},{"id":"CVE-2025-61560","title":"CVE-2025-61560 — A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v","summary":"A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass rate limiting and perform a brute force attack via repeated crafted requests.","source":"NVD","date":"2026-10-09T17:16:41.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61560","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-61560"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2025-61560"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61560"}],"epss":null},{"id":"CVE-2016-20098","title":"CVE-2016-20098 — Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnera","summary":"Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module, which inserts subreddit toolbox wiki fields into popup HTML without encoding. Attackers who can edit the toolbox wiki page can plant JavaScript in fields like pmsubject, header, or reason titles to act with moderators' Reddit sessions.","source":"NVD","date":"2026-10-09T17:16:38.583Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20098","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2016-20098"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2016-20098"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-20098"}],"epss":null},{"id":"GHSA-68W4-83FH-F2W8","title":"pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password","source":"GitHub Advisories","date":"2026-10-09T17:09:15Z","summary":"ANY)` and are reachable at `/api/getUserData` and `/api/get_userdata`.  ** Both methods are thin wrappers around `check_auth()`, which the maintainers deliberately restricted to administrators by omitting `@permission` (no entry in `perm_map`, so `is_authorized()` returns `False` for non-admins).","url":"https://github.com/advisories/GHSA-68w4-83fh-f2w8","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["GHSA-68W4-83FH-F2W8"],"kev":false,"recordIds":["GHSA-68w4-83fh-f2w8"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-68w4-83fh-f2w8"}],"epss":null},{"id":"GHSA-9Q47-3CM2-2RP8","title":"pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header","source":"GitHub Advisories","date":"2026-10-09T17:09:12Z","summary":"## Summary pyLoad determines the \"client IP\" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied `X-Forwarded-For` (XFF) HTTP header and taking the leftmost value.  No trusted-proxy configuration exists (the Cheroot WSGI server faces clients directly, and there is no `ProxyFix` middleware).","url":"https://github.com/advisories/GHSA-9q47-3cm2-2rp8","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-9Q47-3CM2-2RP8"],"kev":false,"recordIds":["GHSA-9q47-3cm2-2rp8"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9q47-3cm2-2rp8"}],"epss":null},{"id":"GHSA-JQ7H-WRVP-3RGX","title":"pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session","source":"GitHub Advisories","date":"2026-10-09T17:09:09Z","summary":"An admin who revokes a user's privileges through the REST API does not actually revoke them, because the session carrying those privileges is never invalidated.  pyLoad authorizes each request from values copied into the Flask session at login.","url":"https://github.com/advisories/GHSA-jq7h-wrvp-3rgx","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["GHSA-JQ7H-WRVP-3RGX"],"kev":false,"recordIds":["GHSA-jq7h-wrvp-3rgx"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-jq7h-wrvp-3rgx"}],"epss":null},{"id":"GHSA-889W-M37P-88M5","title":"pyLoad: Api.set_user_permission never invalidates the target's session","source":"GitHub Advisories","date":"2026-10-09T17:09:07Z","summary":"g.  `POST /api/set_user_permission` (or its legacy alias `/api/setUserPermission`) — updates the target's database row but never invalidates that user's existing Flask cookie session.","url":"https://github.com/advisories/GHSA-889w-m37p-88m5","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["GHSA-889W-M37P-88M5"],"kev":false,"recordIds":["GHSA-889w-m37p-88m5"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-889w-m37p-88m5"}],"epss":null},{"id":"GHSA-P3PR-8F3M-4QP8","title":"pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host","source":"GitHub Advisories","date":"2026-10-09T17:09:03Z","summary":"## Summary pyLoad ships the WindowsPhoneNotify addon, whose `send()` method opens an HTTP connection to a host taken directly from the plugin's `pushurl` configuration value.  A user holding the standard non-admin `SETTINGS` permission can set `pushurl` and `pushid` and enable the addon through the web API, since these plugin options are not in the admin-only option set.","url":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8","topic":"Code & supply chain","read":false,"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-P3PR-8F3M-4QP8"],"kev":false,"recordIds":["GHSA-p3pr-8f3m-4qp8"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p3pr-8f3m-4qp8"}],"epss":null},{"id":"GHSA-FR26-JJHM-638C","title":"pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)","source":"GitHub Advisories","date":"2026-10-09T17:08:58Z","summary":"extractall` without a `filter=`.  py:191-263` is likewise name-only.","url":"https://github.com/advisories/GHSA-fr26-jjhm-638c","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["GHSA-FR26-JJHM-638C"],"kev":false,"recordIds":["GHSA-fr26-jjhm-638c"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fr26-jjhm-638c"}],"epss":null},{"id":"CVE-2026-107812","title":"Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM","source":"GitHub Advisories","date":"2026-10-09T17:08:21Z","summary":"com` mirror), and verifies the binary ONLY by comparing it to that digest: `digestFileContent == DigestSHA512(tarName)`.  Both the binary and the digest come from the same origin, and there is NO cryptographic signature / public-key verification.","url":"https://github.com/advisories/GHSA-662p-52hx-cmh2","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107812","GHSA-662P-52HX-CMH2"],"kev":false,"recordIds":["GHSA-662p-52hx-cmh2","CVE-2026-107812"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-662p-52hx-cmh2"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107812"}],"epss":{"score":0.00173,"date":"2026-10-12","percentile":0.0617}},{"id":"CVE-2026-107808","title":"Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)","source":"GitHub Advisories","date":"2026-10-09T17:08:15Z","summary":"## Summary nginx-ui supports two second-factor methods — TOTP (OTP) and WebAuthn passkeys — and reports an account as 2FA-enabled when **either** is configured.  However, the password login endpoint (`POST /api/login`) only enforces a second factor when a **TOTP secret** is present.","url":"https://github.com/advisories/GHSA-45gv-9wjv-xh7p","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107808","GHSA-45GV-9WJV-XH7P"],"kev":false,"recordIds":["GHSA-45gv-9wjv-xh7p","CVE-2026-107808"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-45gv-9wjv-xh7p"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107808"}],"epss":{"score":0.00409,"date":"2026-10-12","percentile":0.33251}},{"id":"CVE-2026-107809","title":"Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs","source":"GitHub Advisories","date":"2026-10-09T17:08:10Z","summary":"3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source.  Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests.","url":"https://github.com/advisories/GHSA-33rr-wq23-g6gg","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107809","GHSA-33RR-WQ23-G6GG"],"kev":false,"recordIds":["GHSA-33rr-wq23-g6gg","CVE-2026-107809"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-33rr-wq23-g6gg"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107809"}],"epss":{"score":0.00185,"date":"2026-10-12","percentile":0.07446}},{"id":"CVE-2026-107813","title":"Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up","source":"GitHub Advisories","date":"2026-10-09T17:08:06Z","summary":"## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up.  An authenticated user whose JWT is stolen or persisted, but who does not hold a fresh secure-session, can perform cluster node CRUD (including reading and rewriting a node token secret) and trigger cluster-wide nginx reload/restart.","url":"https://github.com/advisories/GHSA-h246-wpgf-vmq5","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107813","GHSA-H246-WPGF-VMQ5"],"kev":false,"recordIds":["GHSA-h246-wpgf-vmq5","CVE-2026-107813"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-h246-wpgf-vmq5"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107813"}],"epss":{"score":0.00305,"date":"2026-10-12","percentile":0.21447}},{"id":"CVE-2026-107811","title":"0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser","source":"GitHub Advisories","date":"2026-10-09T17:07:23Z","summary":"Summary 0xJacky/nginx-ui contains a high-severity trust-boundary failure between ordinary users and cluster node credentials.  The source code shows that cluster node list and detail endpoints are reachable by ordinary authenticated users and return node objects containing the token field.","url":"https://github.com/advisories/GHSA-32gc-wf3m-78w9","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107811","GHSA-32GC-WF3M-78W9"],"kev":false,"recordIds":["GHSA-32gc-wf3m-78w9","CVE-2026-107811"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-32gc-wf3m-78w9"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107811"}],"epss":{"score":0.00356,"date":"2026-10-12","percentile":0.27376}},{"id":"CVE-2026-107807","title":"Nginx UI: Node Secret Credential Exposure via URL Query Parameter","source":"GitHub Advisories","date":"2026-10-09T17:07:09Z","summary":"## 1.  Secret` is a master credential that bypasses all JWT/password authentication for the entire API.","url":"https://github.com/advisories/GHSA-pvgv-gcp7-v38g","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107807","GHSA-PVGV-GCP7-V38G"],"kev":false,"recordIds":["GHSA-pvgv-gcp7-v38g","CVE-2026-107807"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pvgv-gcp7-v38g"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107807"}],"epss":{"score":0.00309,"date":"2026-10-12","percentile":0.21893}},{"id":"CVE-2026-107810","title":"Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied","source":"GitHub Advisories","date":"2026-10-09T17:07:05Z","summary":"### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both `restore_nginx` and `restore_nginx_ui` are set to `false`.  zip`, and extracts both inner archives before it decides whether `RestoreNginx` or `RestoreNginxUI` should be applied.","url":"https://github.com/advisories/GHSA-p8v3-89rh-jxc7","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107810","GHSA-P8V3-89RH-JXC7"],"kev":false,"recordIds":["GHSA-p8v3-89rh-jxc7","CVE-2026-107810"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p8v3-89rh-jxc7"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107810"}],"epss":{"score":0.00363,"date":"2026-10-12","percentile":0.28217}},{"id":"GHSA-R44W-V6GF-X3P6","title":"pyLoad has an authentication bypass in API key validation (check_apikey cache)","source":"GitHub Advisories","date":"2026-10-09T16:43:55Z","summary":"## Summary The API-key cache in `check_apikey()` allows an attacker to authenticate with a **forged API key** as long as the legitimate key for the same `key_id` has been used recently.  On a cache hit, the API key **secret is never verified**, resulting in a complete authentication bypass during the cache lifetime.","url":"https://github.com/advisories/GHSA-r44w-v6gf-x3p6","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["GHSA-R44W-V6GF-X3P6"],"kev":false,"recordIds":["GHSA-r44w-v6gf-x3p6"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r44w-v6gf-x3p6"}],"epss":null},{"id":"CVE-2026-90983","title":"CVE-2026-90983 — Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mo","summary":"Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.\n\nThis issue affects Hayat Mobile: from 3.3.0 before 3.4.0.","source":"NVD","date":"2026-10-09T16:17:31.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90983","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-90983"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-90983"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90983"}],"epss":null},{"id":"CVE-2026-75349","title":"CVE-2026-75349 — EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in C","summary":"EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.","source":"NVD","date":"2026-10-09T16:17:29.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75349","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75349"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-75349"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75349"}],"epss":null},{"id":"CVE-2026-75348","title":"CVE-2026-75348 — An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf i","summary":"An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed sockaddr structure. This allows a remote attacker to cause a denial of service.","source":"NVD","date":"2026-10-09T16:17:29.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75348","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75348"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-75348"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75348"}],"epss":null},{"id":"CVE-2026-75346","title":"CVE-2026-75346 — An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf","summary":"An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service","source":"NVD","date":"2026-10-09T16:17:29.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75346","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75346"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-75346"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75346"}],"epss":null},{"id":"CVE-2026-75345","title":"CVE-2026-75345 — OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path.","summary":"OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.","source":"NVD","date":"2026-10-09T16:17:29.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75345","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75345"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-75345"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75345"}],"epss":null},{"id":"CVE-2026-108113","title":"CVE-2026-108113 — ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question imp","summary":"ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server user.","source":"NVD","date":"2026-10-09T16:17:26.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108113","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108113"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108113"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108113"}],"epss":null},{"id":"CVE-2026-108112","title":"CVE-2026-108112 — ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated use","summary":"ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because softDelete() skips the PrivilegeUtil.checkAndGetByUuid() ownership check, removing owners' workflows.","source":"NVD","date":"2026-10-09T16:17:26.767Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108112","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108112"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108112"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108112"}],"epss":null},{"id":"CVE-2026-108111","title":"CVE-2026-108111 — ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search e","summary":"ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to list enabled private workflows in the same tenant, including UUIDs and full node and edge configurations.","source":"NVD","date":"2026-10-09T16:17:26.607Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108111","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108111"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108111"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108111"}],"epss":null},{"id":"CVE-2026-108110","title":"CVE-2026-108110 — MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that","summary":"MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send it to /api/documents/fetch or /api/documents/save-blueprint to read private documents and overwrite presentation blueprints.","source":"NVD","date":"2026-10-09T16:17:26.440Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108110","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108110"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108110"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108110"}],"epss":null},{"id":"CVE-2026-107814","title":"CVE-2026-107814 — MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.1","summary":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","source":"NVD","date":"2026-10-09T16:17:26.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107814"],"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107814"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814"}],"epss":null},{"id":"CVE-2026-107783","title":"CVE-2026-107783 — Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow l","summary":"Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Management Console password from command output and log artifacts.\n\n\n\nTo remediate this issue, users should upgrade to version 5.0.306 or later. After upgrading, review PowerShell transcripts and log stores for previously disclosed passwords and rotate any affected IAM console passwords.","source":"NVD","date":"2026-10-09T16:17:24.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107783","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107783"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},"read":false,"kev":false,"recordIds":["CVE-2026-107783"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107783"}],"epss":null},{"id":"CVE-2026-102554","title":"CVE-2026-102554 — Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Goog","summary":"Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.","source":"NVD","date":"2026-10-09T16:17:20.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102554"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve-coordination@google.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102554"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102554"}],"epss":null},{"id":"CVE-2026-95702","title":"CVE-2026-95702 — Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows ","summary":"Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay filesystem. The sentry process remains confined by host-level Linux seccomp and namespace boundaries.","source":"NVD","date":"2026-10-09T15:17:20.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95702","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95702"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve-coordination@google.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95702"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95702"}],"epss":null},{"id":"CVE-2026-78796","title":"CVE-2026-78796 — An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and ","summary":"An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\\cgi-bin\\upgrade file","source":"NVD","date":"2026-10-09T15:17:15.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78796","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78796"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-78796"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78796"}],"epss":null},{"id":"CVE-2026-78795","title":"CVE-2026-78795 — An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and ","summary":"An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information","source":"NVD","date":"2026-10-09T15:17:15.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78795","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78795"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78795"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78795"}],"epss":null},{"id":"CVE-2026-39460","title":"CVE-2026-39460 — Usernames and passwords, including the default factory credentials, are stored in plaintext within the co","summary":"Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.","source":"NVD","date":"2026-10-09T15:17:14.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39460","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-39460"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-39460"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39460"}],"epss":null},{"id":"CVE-2026-32645","title":"CVE-2026-32645 — Default factory credentials with administrative access are enabled and persist even after configuring oth","summary":"Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.","source":"NVD","date":"2026-10-09T15:17:14.017Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32645","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-32645"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-32645"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32645"}],"epss":null},{"id":"CVE-2026-108125","title":"CVE-2026-108125 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-","summary":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.\n\nThis issue affects wp-post-author version 4.0.0 prior to 4.1.0.","source":"NVD","date":"2026-10-09T15:17:12.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108125","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108125"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"vulnreport@tenable.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108125"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108125"}],"epss":null},{"id":"CVE-2026-108124","title":"CVE-2026-108124 — Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-","summary":"Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.\n\nThis issue affects wp-post-author before 4.1.0.","source":"NVD","date":"2026-10-09T15:17:12.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108124","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108124"],"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","source":"vulnreport@tenable.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108124"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108124"}],"epss":null},{"id":"CVE-2026-108109","title":"CVE-2026-108109 — PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset fl","summary":"PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.","source":"NVD","date":"2026-10-09T15:17:12.047Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108109","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108109"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108109"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108109"}],"epss":null},{"id":"CVE-2026-108108","title":"CVE-2026-108108 — PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification ","summary":"PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in through MikroTik hotspot or PPPoE CHAP with any incorrect password to obtain network access and consume that customer's plan.","source":"NVD","date":"2026-10-09T15:17:11.887Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108108","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108108"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108108"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108108"}],"epss":null},{"id":"CVE-2026-108107","title":"CVE-2026-108107 — PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php Fr","summary":"PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.","source":"NVD","date":"2026-10-09T15:17:11.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108107","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108107"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108107"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108107"}],"epss":null},{"id":"CVE-2026-108106","title":"CVE-2026-108106 — Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows atta","summary":"Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.","source":"NVD","date":"2026-10-09T15:17:11.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108106"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108106"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106"}],"epss":null},{"id":"CVE-2026-108105","title":"CVE-2026-108105 — Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request(","summary":"Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.","source":"NVD","date":"2026-10-09T15:17:11.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108105","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108105"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108105"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108105"}],"epss":null},{"id":"CVE-2026-108104","title":"CVE-2026-108104 — Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedI","summary":"Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.","source":"NVD","date":"2026-10-09T15:17:11.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108104","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108104"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108104"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108104"}],"epss":null},{"id":"CVE-2026-108103","title":"CVE-2026-108103 — Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traff","summary":"Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.","source":"NVD","date":"2026-10-09T15:17:11.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108103","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108103"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108103"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108103"}],"epss":null},{"id":"CVE-2026-108102","title":"CVE-2026-108102 — Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measureme","summary":"Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.","source":"NVD","date":"2026-10-09T15:17:10.850Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108102","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108102"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108102"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108102"}],"epss":null},{"id":"CVE-2026-108101","title":"CVE-2026-108101 — HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachme","summary":"HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.","source":"NVD","date":"2026-10-09T15:17:10.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108101","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108101"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108101"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108101"}],"epss":null},{"id":"CVE-2026-108100","title":"CVE-2026-108100 — HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holder","summary":"HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.","source":"NVD","date":"2026-10-09T15:17:10.443Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108100","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108100"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108100"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108100"}],"epss":null},{"id":"CVE-2026-104117","title":"CVE-2026-104117 — A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change","summary":"A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a)","source":"NVD","date":"2026-10-09T15:17:07.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104117","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104117"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104117"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104117"}],"epss":null},{"id":"CVE-2026-104116","title":"CVE-2026-104116 — A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in a","summary":"A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSD_CMD_NEW_ZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6","source":"NVD","date":"2026-10-09T15:17:07.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104116","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104116"],"cvss":{"score":1.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104116"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104116"}],"epss":null},{"id":"CVE-2026-104115","title":"CVE-2026-104115 — A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash","summary":"A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components of a reparse string into a fixed 1024-byte stack buffer without checking their length. The reparsed door at /var/run/reparsed_door is readable by all users and the door server does not check the caller's credentials, so an unprivileged local user can send an nfs-basic request with an overlong host or path component to overflow the buffer. On systems built with stack protection, which is the default, this causes reparsed to abort; repeated requests place the svc:/system/filesystem/reparse service into maintenance. The service is disabled by default. The flaw has existed since 2009 (il","source":"NVD","date":"2026-10-09T15:17:07.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104115","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104115"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104115"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104115"}],"epss":null},{"id":"CVE-2026-104114","title":"CVE-2026-104114 — A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash ","summary":"A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.","source":"NVD","date":"2026-10-09T15:17:07.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104114","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104114"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104114"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104114"}],"epss":null},{"id":"CVE-2026-104113","title":"CVE-2026-104113 — A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash th","summary":"A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not","source":"NVD","date":"2026-10-09T15:17:07.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104113","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104113"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104113"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104113"}],"epss":null},{"id":"CVE-2026-104112","title":"CVE-2026-104112 — A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exh","summary":"A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb","source":"NVD","date":"2026-10-09T15:17:07.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104112","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104112"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-104112"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104112"}],"epss":null},{"id":"CVE-2026-104081","title":"CVE-2026-104081 — KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within a","summary":"KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like \"....//\", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.","source":"NVD","date":"2026-10-09T15:17:06.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104081","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104081"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104081"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104081"}],"epss":null},{"id":"CVE-2026-102916","title":"CVE-2026-102916 — A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When em","summary":"A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.","source":"NVD","date":"2026-10-09T15:17:06.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102916","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102916"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:C/RE:X/U:X","source":"0ca53633-f0b5-4853-ba72-e0a2e62000d0"},"read":false,"kev":false,"recordIds":["CVE-2026-102916"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102916"}],"epss":null},{"id":"CVE-2026-94067","title":"CVE-2026-94067 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') v","summary":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.","source":"NVD","date":"2026-10-09T14:17:26.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94067","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94067"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94067"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94067"}],"epss":null},{"id":"CVE-2026-94066","title":"CVE-2026-94066 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spa","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.","source":"NVD","date":"2026-10-09T14:17:25.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94066","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94066"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94066"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94066"}],"epss":null},{"id":"CVE-2026-94063","title":"CVE-2026-94063 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.","source":"NVD","date":"2026-10-09T14:17:24.990Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94063","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94063"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94063"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94063"}],"epss":null},{"id":"CVE-2026-92085","title":"CVE-2026-92085 — Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT","summary":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS.\n\nThis issue affects Talassoft Industrial Management Software: before V16.0.1.","source":"NVD","date":"2026-10-09T14:17:24.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92085","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92085"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-92085"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92085"}],"epss":null},{"id":"CVE-2026-79363","title":"CVE-2026-79363 — Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer f","summary":"Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.","source":"NVD","date":"2026-10-09T14:17:22.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79363","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-79363"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-79363"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79363"}],"epss":null},{"id":"CVE-2026-62026","title":"CVE-2026-62026 — Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cr","summary":"Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.","source":"NVD","date":"2026-10-09T14:17:22.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62026","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62026"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62026"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62026"}],"epss":null},{"id":"CVE-2026-108063","title":"CVE-2026-108063 — A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an e","summary":"A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).","source":"NVD","date":"2026-10-09T14:17:20.130Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108063","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108063"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-108063"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108063"}],"epss":null},{"id":"CVE-2026-107803","title":"CVE-2026-107803 — ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/","summary":"ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\\Traits\\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.","source":"NVD","date":"2026-10-09T14:17:19.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107803","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107803"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107803"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107803"}],"epss":null},{"id":"CVE-2026-107785","title":"CVE-2026-107785 — Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When ","summary":"Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted.\n\n\n\nFor a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the \"Enforce SKA Use\" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (o","source":"NVD","date":"2026-10-09T14:17:19.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107785","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107785"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Amber","source":"d0a6edd6-4b7d-45f2-a6f9-9b944f7b6132"},"read":false,"kev":false,"recordIds":["CVE-2026-107785"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107785"}],"epss":null},{"id":"CVE-2026-106581","title":"CVE-2026-106581 — Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker De","summary":"Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.","source":"NVD","date":"2026-10-09T14:17:18.433Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106581","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106581"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@docker.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106581"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106581"}],"epss":null},{"id":"CVE-2026-104629","title":"CVE-2026-104629 — A component loading mechanism in openPDC and openHistorian will construct and run any specified type, whi","summary":"A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.","source":"NVD","date":"2026-10-09T14:17:11.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104629","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104629"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-104629"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104629"}],"epss":null},{"id":"CVE-2026-101022","title":"CVE-2026-101022 — A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no re","summary":"A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.","source":"NVD","date":"2026-10-09T14:17:10.157Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101022","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101022"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-101022"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101022"}],"epss":null},{"id":"CVE-2026-107727","title":"Strawberry legacy graphql-ws retains naturally completed subscription slots","source":"GitHub Advisories","date":"2026-10-09T14:07:20Z","summary":"### Summary Strawberry's legacy `graphql-ws` subscription handler can retain task and subscription bookkeeping after a one-shot subscription has naturally sent its `complete` message.  tasks)`.","url":"https://github.com/advisories/GHSA-m952-2w3f-6r8h","topic":"Code & supply chain","read":false,"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-107727","GHSA-M952-2W3F-6R8H"],"kev":false,"recordIds":["GHSA-m952-2w3f-6r8h","CVE-2026-107727"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-m952-2w3f-6r8h"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107727"}],"epss":{"score":0.0035,"date":"2026-10-12","percentile":0.26701}},{"id":"CVE-2026-107728","title":"Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy","source":"GitHub Advisories","date":"2026-10-09T14:07:16Z","summary":"resolve()` evaluates the return value of `has_permission()` for truthiness on the synchronous path.  iscoroutinefunction`), so a plain `def` that returns an awaitable is treated as synchronous.","url":"https://github.com/advisories/GHSA-pfvf-fwfp-25mp","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107728","GHSA-PFVF-FWFP-25MP"],"kev":false,"recordIds":["GHSA-pfvf-fwfp-25mp","CVE-2026-107728"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pfvf-fwfp-25mp"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107728"}],"epss":{"score":0.00353,"date":"2026-10-12","percentile":0.27047}},{"id":"https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html","title":"TP-Link Sued by Four More U.S. States Over Router Security and China Ties","source":"The Hacker News","date":"2026-10-09T13:22:53.000Z","summary":"S.  states sued router maker TP-Link Systems on October 6, bringing the total to five, with &nbsp;Texas filing a suit in February.","url":"https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/tp-link-sued-by-four-more-us-states.html"}],"epss":null},{"id":"CVE-2026-96396","title":"CVE-2026-96396 — The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate ","summary":"The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.","source":"NVD","date":"2026-10-09T13:17:13.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96396","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96396"],"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-96396"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96396"}],"epss":null},{"id":"CVE-2026-96395","title":"CVE-2026-96395 — The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds c","summary":"The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.","source":"NVD","date":"2026-10-09T13:17:12.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96395","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96395"],"cvss":{"score":3.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-96395"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96395"}],"epss":null},{"id":"CVE-2026-96394","title":"CVE-2026-96394 — The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image di","summary":"The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.","source":"NVD","date":"2026-10-09T13:17:12.793Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96394","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96394"],"cvss":{"score":2.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-96394"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96394"}],"epss":null},{"id":"CVE-2026-96393","title":"CVE-2026-96393 — The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking wh","summary":"The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.","source":"NVD","date":"2026-10-09T13:17:12.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96393","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96393"],"cvss":{"score":3.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-96393"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96393"}],"epss":null},{"id":"CVE-2026-94062","title":"CVE-2026-94062 — Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') v","summary":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.","source":"NVD","date":"2026-10-09T13:17:12.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94062","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94062"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94062"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94062"}],"epss":null},{"id":"CVE-2026-94059","title":"CVE-2026-94059 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bra","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.","source":"NVD","date":"2026-10-09T13:17:11.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94059","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94059"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94059"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94059"}],"epss":null},{"id":"CVE-2026-94058","title":"CVE-2026-94058 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bra","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.","source":"NVD","date":"2026-10-09T13:17:11.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94058","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94058"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94058"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94058"}],"epss":null},{"id":"CVE-2026-8374","title":"CVE-2026-8374 — Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker t","summary":"Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.","source":"NVD","date":"2026-10-09T13:17:11.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8374","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-8374"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:D/RE:H/U:Red","source":"a341c0d1-ebf7-493f-a84e-38cf86618674"},"read":false,"kev":false,"recordIds":["CVE-2026-8374"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8374"}],"epss":null},{"id":"CVE-2026-86405","title":"CVE-2026-86405 — Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Serv","summary":"Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.","source":"NVD","date":"2026-10-09T13:17:11.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86405","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86405"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-86405"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86405"}],"epss":null},{"id":"CVE-2026-85531","title":"CVE-2026-85531 — Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Serv","summary":"Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.","source":"NVD","date":"2026-10-09T13:17:10.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85531","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85531"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-85531"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85531"}],"epss":null},{"id":"CVE-2026-62029","title":"CVE-2026-62029 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPF","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.","source":"NVD","date":"2026-10-09T13:17:10.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62029","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62029"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62029"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62029"}],"epss":null},{"id":"CVE-2026-106601","title":"CVE-2026-106601 — Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allo","summary":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.This issue affects Jetpack: from n/a through 16.2.","source":"NVD","date":"2026-10-09T13:17:09.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106601","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106601"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106601"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106601"}],"epss":null},{"id":"CVE-2026-105883","title":"CVE-2026-105883 — Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectl","summary":"Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.","source":"NVD","date":"2026-10-09T13:17:09.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105883","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105883"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105883"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105883"}],"epss":null},{"id":"CVE-2026-105877","title":"CVE-2026-105877 — Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analyti","summary":"Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.","source":"NVD","date":"2026-10-09T13:17:09.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105877","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105877"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105877"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105877"}],"epss":null},{"id":"CVE-2026-105318","title":"CVE-2026-105318 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dat","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.","source":"NVD","date":"2026-10-09T13:17:08.470Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105318","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105318"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105318"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105318"}],"epss":null},{"id":"CVE-2026-104392","title":"CVE-2026-104392 — Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next al","summary":"Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.","source":"NVD","date":"2026-10-09T13:17:08.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104392","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104392"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104392"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104392"}],"epss":null},{"id":"CVE-2026-104079","title":"CVE-2026-104079 — Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversio","summary":"Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-privileged authenticated users to create and publish Envira galleries without the required capabilities, because the endpoint only checks edit permissions on the source post and uses a hard-coded publish status. Attackers can also supply arbitrary caller-controlled image IDs without ownership verification to publish unauthorized content using attachments they are not authorized to use.","source":"NVD","date":"2026-10-09T13:17:07.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104079","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104079"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104079"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104079"}],"epss":null},{"id":"CVE-2026-103413","title":"CVE-2026-103413 — Improper input validation vulnerability in Apache Camel Karavan.\n\n\n\nWhen a deployment was started, Karava","summary":"Improper input validation vulnerability in Apache Camel Karavan.\n\n\n\nWhen a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan apply arbitrary Kubernetes resources within the reach of its service account, including pods requesting hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation or added capabilities.\n\n\n\nThis issue affects Apache Camel Karavan: from 4.0.0 before 4.22.1.\n\n\n\nUsers are recommended to upgrade to version 4.22.1, which fixes the issue.","source":"NVD","date":"2026-10-09T13:17:07.633Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103413","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103413"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security@apache.org"},"read":false,"kev":false,"recordIds":["CVE-2026-103413"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103413"}],"epss":null},{"id":"CVE-2026-103412","title":"CVE-2026-103412 — Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Ca","summary":"Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.\n\n\n\nA project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container.\n\n\n\nThis issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1.\n\n\n\nUsers are recommended to upgrade to version 4.22.1, which fixes the issue.","source":"NVD","date":"2026-10-09T13:17:07.453Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103412","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103412"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security@apache.org"},"read":false,"kev":false,"recordIds":["CVE-2026-103412"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103412"}],"epss":null},{"id":"CVE-2026-103220","title":"CVE-2026-103220 — The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds che","summary":"The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.","source":"NVD","date":"2026-10-09T13:17:07.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103220","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103220"],"cvss":{"score":4.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-103220"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103220"}],"epss":null},{"id":"CVE-2026-101130","title":"CVE-2026-101130 — The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds che","summary":"The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.","source":"NVD","date":"2026-10-09T13:17:07.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101130","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101130"],"cvss":{"score":3.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-101130"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101130"}],"epss":null},{"id":"CVE-2026-101094","title":"CVE-2026-101094 — The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete","summary":"The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.","source":"NVD","date":"2026-10-09T13:17:05.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101094","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101094"],"cvss":{"score":3.6,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","source":"61adb53e-e4b3-47f7-8a93-4717c9e77dc6"},"read":false,"kev":false,"recordIds":["CVE-2026-101094"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101094"}],"epss":null},{"id":"https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html","title":"Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access","source":"The Hacker News","date":"2026-10-09T12:59:22.000Z","summary":"Security researchers have&nbsp;published a full working exploit&nbsp;for a pre-authentication remote code execution flaw in AnyDesk Linux that gives attackers root access before anyone approves the connection.  3 in June, but its&nbsp;changelog&nbsp;described the fix only as \"fixed a bug that could lead to a crash,\" with no CVE assigned and no security","url":"https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/researchers-publish-working-exploit-for.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/anthropic-launches-free-ai.html","title":"Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects","source":"The Hacker News","date":"2026-10-09T12:47:28.000Z","summary":"Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).  \"It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing,\" Anthropic said.","url":"https://thehackernews.com/2026/10/anthropic-launches-free-ai.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/anthropic-launches-free-ai.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/anthropic-launches-free-ai.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html","title":"Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge","source":"The Hacker News","date":"2026-10-09T12:47:26.000Z","summary":"Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners.  java\"","url":"https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/attackers-exploit-ahsaycbs-flaws-to.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html","title":"Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies","source":"The Hacker News","date":"2026-10-09T12:21:51.000Z","summary":"S.  Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.","url":"https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html"}],"epss":null},{"id":"CVE-2026-89235","title":"CVE-2026-89235 — The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter b","summary":"The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.","source":"NVD","date":"2026-10-09T12:17:12.983Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89235","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89235"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-89235"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89235"}],"epss":null},{"id":"CVE-2026-87846","title":"CVE-2026-87846 — The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or","summary":"The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete the shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request for those orders using the store's own stored API credentials.","source":"NVD","date":"2026-10-09T12:17:12.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87846","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87846"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87846"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87846"}],"epss":null},{"id":"CVE-2026-86851","title":"CVE-2026-86851 — The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key ch","summary":"The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.","source":"NVD","date":"2026-10-09T12:17:12.737Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86851","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86851"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-86851"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86851"}],"epss":null},{"id":"CVE-2026-85348","title":"CVE-2026-85348 — The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one","summary":"The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","source":"NVD","date":"2026-10-09T12:17:12.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85348","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85348"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85348"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85348"}],"epss":null},{"id":"CVE-2026-62042","title":"CVE-2026-62042 — Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiti","summary":"Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.","source":"NVD","date":"2026-10-09T12:17:11.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62042","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62042"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62042"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62042"}],"epss":null},{"id":"CVE-2026-62041","title":"CVE-2026-62041 — Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting I","summary":"Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Manager: from n/a through 3.4.1.","source":"NVD","date":"2026-10-09T12:17:11.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62041","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62041"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62041"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62041"}],"epss":null},{"id":"CVE-2026-62040","title":"CVE-2026-62040 — Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force ","summary":"Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1.","source":"NVD","date":"2026-10-09T12:17:10.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62040","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62040"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62040"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62040"}],"epss":null},{"id":"CVE-2026-39779","title":"CVE-2026-39779 — Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly ","summary":"Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Asgaros Forum: from n/a through 3.4.0.","source":"NVD","date":"2026-10-09T12:17:10.513Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39779","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-39779"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-39779"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39779"}],"epss":null},{"id":"CVE-2026-103329","title":"CVE-2026-103329 — The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming p","summary":"The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incoming payment webhook notifications, as the signing key used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid signature and mark arbitrary WooCommerce orders as paid without payment.","source":"NVD","date":"2026-10-09T12:17:07.437Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103329","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103329"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103329"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103329"}],"epss":null},{"id":"https://www.securityweek.com/?p=49913","title":"In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years","source":"SecurityWeek","date":"2026-10-09T12:03:50.000Z","summary":"Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry.  The post In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years appeared first on SecurityWeek .","url":"https://www.securityweek.com/in-other-news-ai-used-in-korean-bank-breaches-poem-guided-botnet-empire-admin-gets-40-years/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49913"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/in-other-news-ai-used-in-korean-bank-breaches-poem-guided-botnet-empire-admin-gets-40-years/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49909","title":"Google Domains Impacted by Recent ccTLD Hijacks","source":"SecurityWeek","date":"2026-10-09T11:43:14.000Z","summary":"as ccTLDs and obtained HTTPS certificates for several Google domains.  The post Google Domains Impacted by Recent ccTLD Hijacks appeared first on SecurityWeek .","url":"https://www.securityweek.com/google-domains-impacted-by-recent-cctld-domain-hijacks/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49909"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/google-domains-impacted-by-recent-cctld-domain-hijacks/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html","title":"The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition","source":"The Hacker News","date":"2026-10-09T11:30:00.000Z","summary":"As enterprises race to deploy autonomous AI agents to accelerate business, a new report reveals they are tethered to security architectures built for a different era.  The \"Horizons of Identity Security\" report from SailPoint highlights a critical “velocity paradox,” in which organizations invest in AI-speed business operations while continuing to rely on human-speed security controls, creating a","url":"https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/the-ai-velocity-paradox-why-security-is.html"}],"epss":null},{"id":"CVE-2026-97791","title":"CVE-2026-97791 — In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate befor","summary":"In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it could be accepted as trusted without ever reaching the STS. Only services that use STSTokenValidator to validate SAML tokens without alwaysValidateToSts set are affected. \nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:03.380Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97791","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97791"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-97791"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97791"}],"epss":null},{"id":"CVE-2026-97468","title":"CVE-2026-97468 — Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a ","summary":"Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode()), and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token (for example a UsernameToken or a self-signed SAML Assertion) whose hash collides with a cached entry. The token would then be accepted without password validation, signature trust verification or a call to the STS. This could let the attacker authenticate as another user and, through STS token validation or renewal, obtain STS-signed tokens for that identity.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:03.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97468","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97468"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-97468"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97468"}],"epss":null},{"id":"CVE-2026-86463","title":"CVE-2026-86463 — Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions.","summary":"Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafted query to make the server use up CPU resources, potentially slowing down or stopping other requests. The fix was to limit FIQL expressions to 4 KiB by default, preventing attackers from sending extremely long inputs while still allowing normal queries.\n\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:03.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86463","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86463"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-86463"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86463"}],"epss":null},{"id":"CVE-2026-79650","title":"CVE-2026-79650 — Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after succes","summary":"Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP’s origin. Both directly encoded and double-encoded external URLs can trigger the issue, depending on which validation path is used. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:03.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79650","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-79650"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-79650"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79650"}],"epss":null},{"id":"CVE-2026-78384","title":"CVE-2026-78384 — CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small","summary":"CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF (e.g. JoseSessionTokenProvider with RSA-OAEP key wrap) and via SAML redirect/POST binding token inflation — in both cases decompression happens before/independent of trust validation.\n\nFix: Added a configurable maximum inflated-size cap (default 10 MiB, org.apache.cxf.compression-max-inflated-size system property) to CompressionUtils.inflate(); aborts with DataFormatException once exceeded.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:02.937Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78384","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78384"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-78384"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78384"}],"epss":null},{"id":"CVE-2026-73179","title":"CVE-2026-73179 — Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code gran","summary":"Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fixes this issue.","source":"NVD","date":"2026-10-09T11:17:02.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73179","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-73179"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-73179"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73179"}],"epss":null},{"id":"CVE-2026-71575","title":"CVE-2026-71575 — The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a millis","summary":"The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:02.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-71575"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-71575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71575"}],"epss":null},{"id":"CVE-2026-108039","title":"CVE-2026-108039 — By default, StaxUtils placed no limit on the total number of elements or the total number of characters i","summary":"By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:02.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108039","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-108039"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-108039"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108039"}],"epss":null},{"id":"CVE-2026-107938","title":"CVE-2026-107938 — In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify","summary":"In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint’s identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials. \nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:02.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107938","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107938"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-107938"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107938"}],"epss":null},{"id":"CVE-2026-107937","title":"CVE-2026-107937 — In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured","summary":"In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits. The size limit was applied only to each physical line, not to a header value built from continuation lines or to the combined values of a repeated header. The count limit was checked against the number of distinct header names, not the total number of header lines. A remote, unauthenticated attacker could send a multipart request with very large folded or repeated part headers. The server would then allocate memory without bound, causing a denial of service. \nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:02.107Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107937","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107937"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-107937"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107937"}],"epss":null},{"id":"CVE-2026-100227","title":"CVE-2026-100227 — Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module","summary":"Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor) did not ensure that the XML passed to the application was covered by the signature. An attacker with any document signed by a trusted key could wrap it in unsigned content, which the application would then treat as signed.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.","source":"NVD","date":"2026-10-09T11:17:01.993Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100227","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-100227"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-100227"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100227"}],"epss":null},{"id":"https://www.securityweek.com/?p=49907","title":"Unpatched AhsayCBS Vulnerabilities Exploited in the Wild","source":"SecurityWeek","date":"2026-10-09T10:23:42.000Z","summary":"The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.  The post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek .","url":"https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49907"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/"}],"epss":null},{"id":"CVE-2026-96761","title":"CVE-2026-96761 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wel","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.","source":"NVD","date":"2026-10-09T10:16:45.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96761","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96761"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96761"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96761"}],"epss":null},{"id":"CVE-2026-96671","title":"CVE-2026-96671 — Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-u","summary":"Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forgery.This issue affects Featured Image from URL: from n/a through 6.0.7.","source":"NVD","date":"2026-10-09T10:16:45.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96671","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96671"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96671"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96671"}],"epss":null},{"id":"CVE-2026-96607","title":"CVE-2026-96607 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.","source":"NVD","date":"2026-10-09T10:16:45.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96607","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96607"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96607"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96607"}],"epss":null},{"id":"CVE-2026-96518","title":"CVE-2026-96518 — Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incor","summary":"Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.","source":"NVD","date":"2026-10-09T10:16:45.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96518","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96518"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96518"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96518"}],"epss":null},{"id":"CVE-2026-96461","title":"CVE-2026-96461 — Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured ","summary":"Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.","source":"NVD","date":"2026-10-09T10:16:45.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96461","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96461"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96461"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96461"}],"epss":null},{"id":"CVE-2026-96337","title":"CVE-2026-96337 — Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incor","summary":"Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.17.3.","source":"NVD","date":"2026-10-09T10:16:44.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96337","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96337"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96337"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96337"}],"epss":null},{"id":"CVE-2026-96333","title":"CVE-2026-96333 — Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spo","summary":"Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identity Spoofing.This issue affects GiveWP: from n/a through 4.16.8.1.","source":"NVD","date":"2026-10-09T10:16:44.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96333","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96333"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96333"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96333"}],"epss":null},{"id":"CVE-2026-96332","title":"CVE-2026-96332 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yal","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.","source":"NVD","date":"2026-10-09T10:16:44.320Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96332","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96332"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96332"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96332"}],"epss":null},{"id":"CVE-2026-96331","title":"CVE-2026-96331 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpd","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.","source":"NVD","date":"2026-10-09T10:16:44.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96331","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96331"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96331"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96331"}],"epss":null},{"id":"CVE-2026-96328","title":"CVE-2026-96328 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jeg","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.","source":"NVD","date":"2026-10-09T10:16:43.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96328","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96328"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96328"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96328"}],"epss":null},{"id":"CVE-2026-96327","title":"CVE-2026-96327 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vib","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.","source":"NVD","date":"2026-10-09T10:16:43.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96327","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96327"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96327"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96327"}],"epss":null},{"id":"CVE-2026-95610","title":"CVE-2026-95610 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpS","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.","source":"NVD","date":"2026-10-09T10:16:43.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95610","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95610"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95610"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95610"}],"epss":null},{"id":"CVE-2026-95607","title":"CVE-2026-95607 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vib","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS  wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.","source":"NVD","date":"2026-10-09T10:16:42.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95607","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95607"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95607"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95607"}],"epss":null},{"id":"CVE-2026-95599","title":"CVE-2026-95599 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tas","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.","source":"NVD","date":"2026-10-09T10:16:42.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95599","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95599"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95599"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95599"}],"epss":null},{"id":"CVE-2026-95598","title":"CVE-2026-95598 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cod","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.","source":"NVD","date":"2026-10-09T10:16:42.643Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95598","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95598"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95598"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95598"}],"epss":null},{"id":"CVE-2026-95591","title":"CVE-2026-95591 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4j","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.","source":"NVD","date":"2026-10-09T10:16:42.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95591","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95591"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95591"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95591"}],"epss":null},{"id":"CVE-2026-95589","title":"CVE-2026-95589 — Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce adva","summary":"Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.","source":"NVD","date":"2026-10-09T10:16:42.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95589","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95589"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-95589"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95589"}],"epss":null},{"id":"CVE-2026-94668","title":"CVE-2026-94668 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dim","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.","source":"NVD","date":"2026-10-09T10:16:41.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94668","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94668"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94668"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94668"}],"epss":null},{"id":"CVE-2026-94665","title":"CVE-2026-94665 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mam","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.","source":"NVD","date":"2026-10-09T10:16:41.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94665","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94665"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94665"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94665"}],"epss":null},{"id":"CVE-2026-94664","title":"CVE-2026-94664 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.o","summary":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0.","source":"NVD","date":"2026-10-09T10:16:41.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94664","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94664"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94664"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94664"}],"epss":null},{"id":"CVE-2026-94663","title":"CVE-2026-94663 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Met","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.","source":"NVD","date":"2026-10-09T10:16:41.283Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94663"],"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94663"}],"epss":null},{"id":"CVE-2026-94632","title":"CVE-2026-94632 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sti","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.","source":"NVD","date":"2026-10-09T10:16:40.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94632","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94632"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94632"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94632"}],"epss":null},{"id":"CVE-2026-94568","title":"CVE-2026-94568 — Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps","summary":"Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.","source":"NVD","date":"2026-10-09T10:16:40.743Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94568","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94568"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94568"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94568"}],"epss":null},{"id":"CVE-2026-94503","title":"CVE-2026-94503 — Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a W","summary":"Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.","source":"NVD","date":"2026-10-09T10:16:40.607Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94503","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94503"],"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94503"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94503"}],"epss":null},{"id":"CVE-2026-94167","title":"CVE-2026-94167 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ext","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.","source":"NVD","date":"2026-10-09T10:16:40.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94167","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94167"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94167"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94167"}],"epss":null},{"id":"CVE-2026-94166","title":"CVE-2026-94166 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpS","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.","source":"NVD","date":"2026-10-09T10:16:40.063Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94166","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94166"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94166"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94166"}],"epss":null},{"id":"CVE-2026-94161","title":"CVE-2026-94161 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.","source":"NVD","date":"2026-10-09T10:16:39.923Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94161","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94161"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94161"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94161"}],"epss":null},{"id":"CVE-2026-93947","title":"CVE-2026-93947 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shi","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.","source":"NVD","date":"2026-10-09T10:16:39.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93947","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93947"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93947"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93947"}],"epss":null},{"id":"CVE-2026-78340","title":"CVE-2026-78340 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limi","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Filesystem access for attacker.","source":"NVD","date":"2026-10-09T10:16:39.253Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78340","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78340"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78340"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78340"}],"epss":null},{"id":"CVE-2026-78339","title":"CVE-2026-78339 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Per","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.","source":"NVD","date":"2026-10-09T10:16:39.103Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78339","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78339"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78339"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78339"}],"epss":null},{"id":"CVE-2026-78027","title":"CVE-2026-78027 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Re","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery.","source":"NVD","date":"2026-10-09T10:16:38.970Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78027","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78027"],"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78027"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78027"}],"epss":null},{"id":"CVE-2026-78025","title":"CVE-2026-78025 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authen","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, and Unauthorized access.","source":"NVD","date":"2026-10-09T10:16:38.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78025","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78025"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78025"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78025"}],"epss":null},{"id":"CVE-2026-78024","title":"CVE-2026-78024 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Re","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass, Server-side request forgery, and Unauthorized access.","source":"NVD","date":"2026-10-09T10:16:38.570Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78024","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78024"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78024"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78024"}],"epss":null},{"id":"CVE-2026-71884","title":"CVE-2026-71884 — In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that th","summary":"In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 bytes, addressing 256, 65536 or 16777216 blocks respectively. Given a longer input the counter wrapped and the keystream repeated from the start of the same packet, and the call then returned the full input length as though every byte had been correctly transformed. Two segments of the message were therefore encrypted under the same keystream, so their plaintexts can be recovered from the ciphertext alone, without the key, while the caller saw neither an exception nor a short length to indicate it. The streaming implementation validates at init and ag","source":"NVD","date":"2026-10-09T10:16:38.260Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71884","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-71884"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","source":"91579145-5d7b-4cc5-b925-a0262ff19630"},"read":false,"kev":false,"recordIds":["CVE-2026-71884"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71884"}],"epss":null},{"id":"CVE-2026-62049","title":"CVE-2026-62049 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cro","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.","source":"NVD","date":"2026-10-09T10:16:38.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62049","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62049"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62049"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62049"}],"epss":null},{"id":"https://www.securityweek.com/?p=49905","title":"Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries","source":"SecurityWeek","date":"2026-10-09T09:55:35.000Z","summary":"Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices.  The post Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries appeared first on SecurityWeek .","url":"https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49905"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/pre-baked-firmware-malware-hits-budget-android-devices-in-150-countries/"}],"epss":null},{"id":"CVE-2026-84224","title":"CVE-2026-84224 — The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching i","summary":"The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response.","source":"NVD","date":"2026-10-09T09:17:10.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84224","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84224"],"cvss":{"score":4.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84224"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84224"}],"epss":null},{"id":"CVE-2026-84220","title":"CVE-2026-84220 — The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed ","summary":"The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields of the page being viewed.","source":"NVD","date":"2026-10-09T09:17:09.857Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84220","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84220"],"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84220"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84220"}],"epss":null},{"id":"CVE-2026-78022","title":"CVE-2026-78022 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Se","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.","source":"NVD","date":"2026-10-09T09:17:09.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78022","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78022"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78022"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78022"}],"epss":null},{"id":"CVE-2026-78021","title":"CVE-2026-78021 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of ","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure.","source":"NVD","date":"2026-10-09T09:17:09.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78021","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78021"],"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78021"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78021"}],"epss":null},{"id":"CVE-2026-78019","title":"CVE-2026-78019 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of ","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesystem access for attacker, and Remote execution.","source":"NVD","date":"2026-10-09T09:17:09.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78019","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78019"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78019"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78019"}],"epss":null},{"id":"CVE-2026-78018","title":"CVE-2026-78018 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initializatio","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.","source":"NVD","date":"2026-10-09T09:17:09.053Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78018","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78018"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78018"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78018"}],"epss":null},{"id":"CVE-2026-78017","title":"CVE-2026-78017 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Chec","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass.","source":"NVD","date":"2026-10-09T09:17:08.927Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78017","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78017"],"cvss":{"score":3.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78017"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78017"}],"epss":null},{"id":"CVE-2026-78016","title":"CVE-2026-78016 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Vali","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information tampering.","source":"NVD","date":"2026-10-09T09:17:08.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78016","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78016"],"cvss":{"score":3.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78016"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78016"}],"epss":null},{"id":"CVE-2026-78015","title":"CVE-2026-78015 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less T","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.","source":"NVD","date":"2026-10-09T09:17:08.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78015","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78015"],"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78015"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78015"}],"epss":null},{"id":"CVE-2026-78013","title":"CVE-2026-78013 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initializatio","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Protection mechanism bypass.","source":"NVD","date":"2026-10-09T09:17:08.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78013","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78013"],"cvss":{"score":5.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78013"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78013"}],"epss":null},{"id":"CVE-2026-76779","title":"CVE-2026-76779 — Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Rest","summary":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.","source":"NVD","date":"2026-10-09T09:17:08.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76779","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76779"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security_alert@emc.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76779"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76779"}],"epss":null},{"id":"CVE-2026-107655","title":"CVE-2026-107655 — A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service impr","summary":"A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Internet Printing Protocol (IPP) request to crash the print daemon, resulting in a temporary Denial of Service (DoS) for all printing services.","source":"NVD","date":"2026-10-09T09:17:08.120Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107655"],"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107655"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107655"}],"epss":null},{"id":"CVE-2026-104635","title":"CVE-2026-104635 — Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauth","summary":"Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3, Protobuf.JSON.decode!/3, or Protobuf.JSON.from_decoded/3 into a schema that contains a self-referential or cyclic message type is affected.\n\nIn lib/protobuf/json/decode.ex, the embedded-message clause of decode_singular/3 recurses into internal_from_json_data/3 once per nesting level without incrementing or checking the decoder's depth counter. The depth guard increase_depth_and_maybe_throw/1 covers only the Google.Protobuf.ListValue and Google.Protobuf.Struct clauses, so the recursion_limit option has no effect on user-defined message types. Each nesting level alloc","source":"NVD","date":"2026-10-09T09:17:07.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104635","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104635"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-104635"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104635"}],"epss":null},{"id":"https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html","title":"GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys","source":"The Hacker News","date":"2026-10-09T09:03:24.000Z","summary":"onion address using only public information, and then take that address over.  Searchlight Cyber, which&nbsp;disclosed the flaw&nbsp;on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.","url":"https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/gobalance-flaw-lets-attackers-hijack.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49902","title":"US Disrupts Chinese State-Sponsored Hacking Tools","source":"SecurityWeek","date":"2026-10-09T08:36:37.000Z","summary":"Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.  The post US Disrupts Chinese State-Sponsored Hacking Tools appeared first on SecurityWeek .","url":"https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49902"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html","title":"Three Teams Demonstrate Remote Hacks of Fully Patched Google Pixel 10 at Pwn2Own","source":"The Hacker News","date":"2026-10-09T08:26:17.000Z","summary":"Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched.  The contest pays researchers to show working exploits and passes the flaws to the vendors.","url":"https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/three-teams-demonstrate-remote-hacks-of.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49900","title":"Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security","source":"SecurityWeek","date":"2026-10-09T08:19:33.000Z","summary":"OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in.  The post Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security appeared first on SecurityWeek .","url":"https://www.securityweek.com/anthropic-fast-tracks-ai-bug-reports-to-oss-maintainers-taps-11-firms-for-ot-security/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49900"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/anthropic-fast-tracks-ai-bug-reports-to-oss-maintainers-taps-11-firms-for-ot-security/"}],"epss":null},{"id":"CVE-2026-98384","title":"CVE-2026-98384 — In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_pr","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk->sk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n <TASK>\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0","source":"NVD","date":"2026-10-09T08:16:56.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98384","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98384"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98384"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98384"}],"epss":null},{"id":"CVE-2026-98383","title":"CVE-2026-98383 — In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() fo","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL\n\nAn LWT_SEG6LOCAL program can invalidate its cached SRH with\nbpf_lwt_seg6_adjust_srh() and then call bpf_skb_pull_data(). The latter\nmay reallocate skb->head, leaving the per-CPU SRH pointer dangling.\nPost-program SRH validation then writes through that pointer.\n\nDisallow bpf_skb_pull_data() for LWT_SEG6LOCAL programs so the verifier\nrejects this unsafe helper combination. Other LWT program types continue\nto expose the helper through lwt_out_func_proto().","source":"NVD","date":"2026-10-09T08:16:56.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98383","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98383"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98383"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98383"}],"epss":null},{"id":"CVE-2026-98382","title":"CVE-2026-98382 — In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs ","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject dev-bound-only programs on other devices\n\n__bpf_offload_dev_match() falls back to comparing offdev pointers after an\nexact netdev mismatch. Bound-only programs normally have NULL offdevs, so\nunrelated netdevs compare equal. A bound-only program on an\noffload-registered netdev can instead inherit a real offdev and match a\nsibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use\nbpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs\nspecialized for the bound driver on the target driver's xdp_buff. Running a\nveth-bound program on tun reads beyond tun's bare stack xdp_buff as a\nveth_xdp_buff.\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n  R","source":"NVD","date":"2026-10-09T08:16:56.680Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98382","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98382"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98382"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98382"}],"epss":null},{"id":"CVE-2026-98381","title":"CVE-2026-98381 — In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers du","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nveth: manage XDP program pointers during channel resize\n\nveth_set_channels() tears down XDP resources for removed RX queues\nwithout clearing rq->xdp_prog.  If the program is then detached or\nreplaced, those queues keep the old pointer after bpf_prog_put().\nA later channel increase can re-enable NAPI and run the freed program.\n\n  BUG: unable to handle page fault for address: ffffc90000256048\n  Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n  RIP: veth_xdp_rcv_skb (include/linux/filter.h:779\n                         include/net/xdp.h:696 drivers/net/veth.c:820)\n  Call Trace:\n   veth_xdp_rcv (drivers/net/veth.c:941)\n   veth_poll (drivers/net/veth.c:986)\n   __napi_poll (net/core/dev.c:7787)\n   net_rx_action (net/core/dev.c:7850 net/core/dev.c:8007)\n   handle_softirqs (kernel/softirq.","source":"NVD","date":"2026-10-09T08:16:56.547Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98381","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98381"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98381"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98381"}],"epss":null},{"id":"CVE-2026-98380","title":"CVE-2026-98380 — In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: reject IDR error pointers when deleting actions\n\ntcf_action_delete() drops the reference held by its lookup before calling\ntcf_idr_delete_index() with the saved action index.  An unlocked\nclassifier can remove that action and reserve the same IDR slot with\nERR_PTR(-EBUSY) in between.\n\ntcf_idr_delete_index() only checks the lookup result for NULL.  It\ntherefore treats the reservation as a tc_action and dereferences\ntcfa_bindcnt.  A hardware execution breakpoint was used to schedule the\ninterleaving without changing the kernel source.  KASAN reported this\ndecoded trace:\n\n  BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010\n  Read of size 4 at addr 0000000000000010 by task poc/150\n  Oops: general protection fault, probably for non-canonical address 0xdffffc","source":"NVD","date":"2026-10-09T08:16:56.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98380","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98380"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98380"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98380"}],"epss":null},{"id":"CVE-2026-98379","title":"CVE-2026-98379 — In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject rou","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rpfilter: reject routes without inet6_dev\n\nip6_route_lookup() can return an error-free route whose rt6i_idev is\nNULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears\ndown its inet6_dev while fib6_ifdown() leaves routes using nexthop objects\nin the FIB. An unprivileged user can construct this state with rtnetlink\nin a private user and network namespace, then trigger a NULL dereference\nthrough an IPv6 rpfilter lookup:\n\n  Oops: general protection fault, probably for non-canonical address\n  0xdffffc0000000000\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75)\n  Call Trace:\n  ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316)\n  nf_hook_slow (net/netfilter/core.","source":"NVD","date":"2026-10-09T08:16:56.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98379","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98379"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98379"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98379"}],"epss":null},{"id":"CVE-2026-98378","title":"CVE-2026-98378 — In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link it","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Skip unsettled links in link iterator\n\nbpf_link_prime() inserts a link into link_idr before anon_inode_getfile()\nsucceeds and before bpf_link_settle() publishes the ID in link->id.\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link\niterator takes a reference without this check.\n\nIf anon_inode_getfile() then fails, the creator removes the ID and frees\nits still-private link directly.  The iterator is left with a dangling\nreference and its next bpf_link_put() accesses freed memory.\n\nTreat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as\nbpf_link_by_id() does.\n\n  BUG: KASAN: slab-use-after-free in bpf_link_put\n  Write of size 8 by task exp/384\n  Call Trace:\n  bpf_link_put                    kernel/bpf/syscall.c:3372\n  bpf_link_s","source":"NVD","date":"2026-10-09T08:16:56.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98378","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98378"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98378"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98378"}],"epss":null},{"id":"CVE-2026-98377","title":"CVE-2026-98377 — In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be p","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvlan: require the MAC header to be present in __vlan_insert_inner_tag()\n\n__vlan_insert_inner_tag() only guarantees head room via skb_cow_head(),\nnever that mac_len bytes of MAC header are present.  Its ETH_HLEN\nwrappers - __vlan_insert_tag() under skb_vlan_push(), and\nvlan_insert_tag() under validate_xmit_vlan() on the generic transmit\npath - therefore rewrite the first 16 bytes at skb->data: a 12-byte\nmemmove plus two 2-byte stores at +12 and +14.  No caller supplies the\nbound, while the pop helpers use skb_ensure_writable()/pskb_may_pull().\n\nAn IFF_TUN device has hard_header_len == 0, so packet_snd() accepts a\none-byte AF_PACKET/SOCK_RAW frame.  The first vlan push only sets a\nhwaccel tag; the next - clsact \"action vlan push\" or\nbpf_skb_vlan_push() - enters the helper ","source":"NVD","date":"2026-10-09T08:16:56.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98377","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98377"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98377"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98377"}],"epss":null},{"id":"CVE-2026-98376","title":"CVE-2026-98376 — In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for pe","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for percpu array inner map replacement\n\npercpu_array_map_ops.map_meta_equal points to the generic\nbpf_map_meta_equal(), which does not compare max_entries.  When a\npercpu array serves as an inner map, replacing it with one that has\nfewer max_entries bypasses the check.  Since percpu_array_map_gen_lookup()\ninlines the original template's index_mask as a JIT immediate, a lookup\non the replacement map can access pptrs[] out of bounds.\n\nPoint percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),\nwhich already enforces the max_entries equality check.\n\nAdd a selftest to verify that replacing a percpu array inner map with\na differently-sized one is rejected.","source":"NVD","date":"2026-10-09T08:16:55.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98376","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-98376"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-98376"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98376"}],"epss":null},{"id":"CVE-2026-97075","title":"CVE-2026-97075 — Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configu","summary":"Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.","source":"NVD","date":"2026-10-09T08:16:55.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97075","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97075"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-97075"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97075"}],"epss":null},{"id":"CVE-2026-4264","title":"CVE-2026-4264 — Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest dem","summary":"Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.","source":"NVD","date":"2026-10-09T08:16:55.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4264","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-4264"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve-coordination@incibe.es"},"read":false,"kev":false,"recordIds":["CVE-2026-4264"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4264"}],"epss":null},{"id":"CVE-2026-19575","title":"CVE-2026-19575 — The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/","summary":"The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). k_object_validate() short-circuits its type comparison when the requested type is K_OBJ_ANY, so the check reduced to \"this pointer is the base address of some kernel object the calling thread has been granted\" — the object's actual type was never compared, and K_SYSCALL_OBJ_INIT also skips the initialization-state check. The sibling handlers z_vrfy_device_init() and z_vrfy_device_is_ready() already used K_OBJ_DRIVER_ANY and were unaffected.\n\nA thread running in user mode can therefore pass any kernel object it holds permission on — most usefully a thread stack object obtained from the k_thread_stack_alloc() syscall or a statically defined K_THREAD_STACK it wa","source":"NVD","date":"2026-10-09T08:16:55.057Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19575"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19575"}],"epss":null},{"id":"CVE-2026-19574","title":"CVE-2026-19574 — The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-r","summary":"The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core/mmu.c). VM_ASID_BITS is 8, so only 255 ASIDs exist; once the counter wrapped, arch_mem_domain_init() could hand an ASID to a new domain while a still-live domain held the same one. Domain-private mappings are installed non-global (MT_NG), so the ASID is the only tag separating one domain's cached translations from another's in the TLB.\n\nThe context-switch path in z_arm64_swap_ptables() only flushes the TLB when the outgoing and incoming domains carry the same ASID, which does not cover a duplicate reached through a third domain: for domains A and C sharing an ASID and an unrelated domain B, the schedule A -> B -> C never takes the flush branch, so the ASID-tagged entries A populat","source":"NVD","date":"2026-10-09T08:16:54.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19574","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19574"],"cvss":{"score":7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19574"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19574"}],"epss":null},{"id":"CVE-2026-19571","title":"CVE-2026-19571 — The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c)","summary":"The ITE IT8xxx2 SHI host-command backend (subsys/mgmt/ec_host_cmd/backends/ec_host_cmd_backend_shi_ite.c) copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data->in_msg and only afterwards checked the protocol version and the derived packet length. The interrupt handler also accepted a chip-select assertion and an Rx-valid-length (RVLI) interrupt in any driver state other than SHI_STATE_DISABLED, so a new header could be parsed while the host-command thread was still processing the previous request out of the very same buffer.\n\nThe host processor is the SPI controller and drives both chip select and the clock. After sending a well-formed request it can immediately de-assert chip select — which returns the driver to the ready state and re-enables the FIFO — and start a second transac","source":"NVD","date":"2026-10-09T08:16:54.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19571","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19571"],"cvss":{"score":6.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19571"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19571"}],"epss":null},{"id":"CVE-2026-19570","title":"CVE-2026-19570 — The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from ","summary":"The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies subgroup metadata from a received Basic Audio Announcement (BASE) into the static Broadcast Audio Scan Service parameter structure mod_src_param without any bounds check. In base_subgroup_meta_cb() the destination element was selected as mod_src_param.subgroups[mod_src_param.num_subgroups] with no test against ARRAY_SIZE(mod_src_param.subgroups) (sized by CONFIG_BT_BAP_BASS_MAX_SUBGROUPS, default 1), and the metadata was copied with memcpy() using the raw on-air length returned by bt_bap_base_get_subgroup_codec_meta() into a metadata array sized by CONFIG_BT_AUDIO_CODEC_CFG_MAX_METADATA_SIZE (default 4). The BASE validator bt_bap_base_get_base_from_ad() only checks structural consistency and permits up to ~24 subgroups and metadata LTVs of ~240 octets.\n\nThe ","source":"NVD","date":"2026-10-09T08:16:54.693Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19570","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19570"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19570"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19570"}],"epss":null},{"id":"CVE-2026-19569","title":"CVE-2026-19569 — dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically","summary":"dynamic_object_create() in kernel/userspace/userspace.c computed the backing allocation for a dynamically allocated kernel object as obj_size_get(otype) + size, and for thread stack elements as STACK_ELEMENT_DATA_SIZE(size) (a round-up plus fixed overhead), without checking either expression for unsigned wrap-around. A size close to SIZE_MAX makes the computed total wrap to a very small value, so the heap chunk handed out is a few bytes while the object descriptor is still tagged with the full requested type and registered in the kernel object table.\n\nThe size argument reaches that arithmetic directly from user mode. k_object_alloc_size() is declared __syscall in include/zephyr/sys/kobject.h, its verifier z_vrfy_k_object_alloc_size() in kernel/userspace/userspace_handler.c is a bare pass-through, and z_object_alloc() only range-checks oty","source":"NVD","date":"2026-10-09T08:16:54.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19569","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19569"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"vulnerabilities@zephyrproject.org"},"read":false,"kev":false,"recordIds":["CVE-2026-19569"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19569"}],"epss":null},{"id":"CVE-2026-106155","title":"CVE-2026-106155 — In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerab","summary":"In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.","source":"NVD","date":"2026-10-09T08:16:54.377Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106155","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106155"],"cvss":{"score":8.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106155"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106155"}],"epss":null},{"id":"CVE-2026-106145","title":"CVE-2026-106145 — In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the ","summary":"In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys. This privilege escalation enables disclosure of protected secrets, including stored data-source credentials and connection strings, and allows agent impersonation and interference with task dispatch.","source":"NVD","date":"2026-10-09T08:16:54.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106145","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106145"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","source":"security@progress.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106145"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106145"}],"epss":null},{"id":"https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html","title":"Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments","source":"The Hacker News","date":"2026-10-09T08:11:33.000Z","summary":"Citrix has released patches for yet another critical security flaw impacting NetScaler ADC and NetScaler Gateway that could result in remote code execution or denial-of-service (DoS) under certain conditions.  \"CVE-2026-107406 is a memory overflow vulnerability that may lead to remote code execution or denial-of-service under specific configuration conditions,\" Citrix said.","url":"https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/citrix-patches-critical-netscaler-flaw.html"}],"epss":null},{"id":"CVE-2026-93548","title":"CVE-2026-93548 — The FooSales  WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to ","summary":"The FooSales  WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales  WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.","source":"NVD","date":"2026-10-09T07:17:19.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93548","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93548"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-93548"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93548"}],"epss":null},{"id":"CVE-2026-92990","title":"CVE-2026-92990 — The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded","summary":"The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.","source":"NVD","date":"2026-10-09T07:17:19.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92990","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92990"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-92990"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92990"}],"epss":null},{"id":"CVE-2026-92989","title":"CVE-2026-92989 — The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on seve","summary":"The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.","source":"NVD","date":"2026-10-09T07:17:19.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92989","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92989"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-92989"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92989"}],"epss":null},{"id":"CVE-2026-88931","title":"CVE-2026-88931 — The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which of its settings may be writ","summary":"The Social Web Suite  WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite  WordPress plugin through 4.1.12 options, including the shared secret that guards its own privileged endpoints.","source":"NVD","date":"2026-10-09T07:17:18.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88931","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88931"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88931"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88931"}],"epss":null},{"id":"CVE-2026-87841","title":"CVE-2026-87841 — The UnitechPay  WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifica","summary":"The UnitechPay  WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state.","source":"NVD","date":"2026-10-09T07:17:18.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87841","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87841"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-87841"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87841"}],"epss":null},{"id":"CVE-2026-86850","title":"CVE-2026-86850 — The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce","summary":"The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those variations' details, with no recoverable copy left behind.","source":"NVD","date":"2026-10-09T07:17:18.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86850","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86850"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86850"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86850"}],"epss":null},{"id":"CVE-2026-81929","title":"CVE-2026-81929 — The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site","summary":"The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.","source":"NVD","date":"2026-10-09T07:17:18.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81929","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81929"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-81929"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81929"}],"epss":null},{"id":"CVE-2026-106097","title":"CVE-2026-106097 — The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter b","summary":"The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.","source":"NVD","date":"2026-10-09T07:17:17.997Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106097","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106097"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-106097"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106097"}],"epss":null},{"id":"CVE-2026-106095","title":"CVE-2026-106095 — The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippe","summary":"The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite network to activate, deactivate and reprioritise network-scoped snippets that run across every site in the network.","source":"NVD","date":"2026-10-09T07:17:17.897Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106095","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106095"],"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-106095"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106095"}],"epss":null},{"id":"CVE-2026-101028","title":"CVE-2026-101028 — Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records","summary":"Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3.\n\nAsh.Actions.Aggregate.run/4 (lib/ash/actions/aggregate.ex) applied only the root resource's read policy before running the aggregate query. The read path also applies each related resource's read policy to filter and sort references that cross a relationship, directly (for example comments.body) or through an aggregate over one, but the aggregate path skipped that step. A caller whose filter or sort reaches these functions, for example through Ash.Query.filter_input/2, an ash_lua script, or an AshAi tool offering count or exists results, can test conditions against related rows hidden from them and recover their existence and attribute values one query at a time. Ash","source":"NVD","date":"2026-10-09T07:17:17.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101028","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101028"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-101028"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101028"}],"epss":null},{"id":"CVE-2025-15700","title":"CVE-2025-15700 — The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an u","summary":"The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.","source":"NVD","date":"2026-10-09T07:17:16.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15700","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-15700"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2025-15700"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15700"}],"epss":null},{"id":"https://www.securityweek.com/?p=49896","title":"Citrix Urges Immediate Patching of Critical NetScaler Vulnerability","source":"SecurityWeek","date":"2026-10-09T06:53:53.000Z","summary":"The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.  The post Citrix Urges Immediate Patching of Critical NetScaler Vulnerability appeared first on SecurityWeek .","url":"https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49896"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/citrix-urges-immediate-patching-of-critical-netscaler-vulnerability/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49894","title":"Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own","source":"SecurityWeek","date":"2026-10-09T06:39:55.000Z","summary":"2 million was paid out at Pwn2Own Ireland 2026 for exploits targeting phones, printers, smart speakers, smart home hubs, and AI infrastructure and coding tools.  The post Google Pixel 10 Exploits Earned Hackers $560,000 at Pwn2Own appeared first on SecurityWeek .","url":"https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49894"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/google-pixel-10-exploits-earned-hackers-560000-at-pwn2own/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html","title":"FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions","source":"The Hacker News","date":"2026-10-09T06:39:29.000Z","summary":"S.  Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.","url":"https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html"}],"epss":null},{"id":"CVE-2026-87110","title":"CVE-2026-87110 — An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring","summary":"An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue.","source":"NVD","date":"2026-10-09T06:17:13.280Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87110","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87110"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87110"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87110"}],"epss":null},{"id":"CVE-2026-87109","title":"CVE-2026-87109 — An authenticated Ops Manager organization member can retrieve another member's pending authenticator enro","summary":"An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.","source":"NVD","date":"2026-10-09T06:17:13.140Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87109","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87109"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87109"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87109"}],"epss":null},{"id":"CVE-2026-87108","title":"CVE-2026-87108 — An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring reco","summary":"An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration details.","source":"NVD","date":"2026-10-09T06:17:12.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87108","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87108"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87108"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87108"}],"epss":null},{"id":"CVE-2026-107914","title":"CVE-2026-107914 — Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports","summary":"Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the \"Synchronize, import, and export configuration\" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs. Therefore, many archives could persist: config.tar.gz, config_0.tar.gz, config_1.tar.gz, etc. There is a separate config.module issue that could allow remote access by an anonymous user, but only for the one filename config.tar.gz.","source":"NVD","date":"2026-10-09T06:17:12.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107914","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107914"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107914"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107914"}],"epss":null},{"id":"CVE-2026-107911","title":"CVE-2026-107911 — A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB be","summary":"A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.","source":"NVD","date":"2026-10-09T06:17:12.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107911","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107911"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107911"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107911"}],"epss":null},{"id":"CVE-2026-107910","title":"CVE-2026-107910 — An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in Falkor","summary":"An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is required; any other error, such as LOADING while a dataset is being loaded, MASTERDOWN during replication failover, or OOM under memory pressure, causes the client to be treated as authenticated. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.","source":"NVD","date":"2026-10-09T06:17:12.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107910","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107910"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107910"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107910"}],"epss":null},{"id":"CVE-2026-107909","title":"CVE-2026-107909 — A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask ","summary":"A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only bounds check in buffer_apply_mask is an ASSERT(), which is compiled out in release builds, so the function XORs memory beyond the end of the receive buffer with the attacker-supplied mask key. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.","source":"NVD","date":"2026-10-09T06:17:12.303Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107909","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107909"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107909"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107909"}],"epss":null},{"id":"CVE-2026-107908","title":"CVE-2026-107908 — A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before","summary":"A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then computes a destination pointer from the wire-supplied 16-bit size and moves buffered data up to about 64 KiB backwards past the start of the read buffer. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.","source":"NVD","date":"2026-10-09T06:17:10.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107908","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107908"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107908"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107908"}],"epss":null},{"id":"CVE-2026-7827","title":"CVE-2026-7827 — A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/d","summary":"A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with an attacker-controlled entity property count. The count sizes two variable-length arrays on the thread stack with no upper bound, and the decoder then fills them with attacker-supplied values.","source":"NVD","date":"2026-10-09T05:16:45.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7827","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-7827"],"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-7827"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7827"}],"epss":null},{"id":"CVE-2026-7826","title":"CVE-2026-7826 — A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializ","summary":"A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the remaining buffer size. The only bounds check is an ASSERT(), which is compiled out in release builds, so memcpy() reads past the end of the heap allocation.","source":"NVD","date":"2026-10-09T05:16:45.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-7826"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-7826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7826"}],"epss":null},{"id":"CVE-2026-5759","title":"CVE-2026-5759 — A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decod","summary":"A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process by supplying a crafted RDB stream whose deleted-nodes buffer length is not a multiple of sizeof(NodeID). The length check relies on ASSERT(), which is compiled out in release builds, so the function continues after freeing the buffer, reading it and freeing it a second time.","source":"NVD","date":"2026-10-09T05:16:44.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5759","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-5759"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-5759"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5759"}],"epss":null},{"id":"CVE-2026-107890","title":"CVE-2026-107890 — OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in ","summary":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing creates unnamed separator attributes with IPP_TAG_ZERO, but add_job() converts these separators to IPP_TAG_JOB. During job startup, get_options()/ipp_length() subsequently calls strlen() on a NULL attribute name, terminating cupsd and disrupting all queues. A single crafted Print-Job request can trigger the crash when the client can reach the scheduler and submit jobs to an accepting, enabled queue supporting the submitted document format. Anonymous submission is possible when permitted by listener and access-control configuration.","source":"NVD","date":"2026-10-09T05:16:44.730Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107890"],"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107890"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107890"}],"epss":null},{"id":"CVE-2026-107889","title":"CVE-2026-107889 — A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the securit","summary":"A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference.","source":"NVD","date":"2026-10-09T05:16:44.583Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107889","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107889"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107889"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107889"}],"epss":null},{"id":"CVE-2026-107888","title":"CVE-2026-107888 — OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked","summary":"OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Temporary-printer cleanup can remove the destination without canceling its held jobs, and the scheduler dereferences the NULL result of cupsdFindDest() while checking holding_new_jobs. This terminates cupsd and interrupts all queues managed by that process. In some plausible scenarios, an unprivileged submission can trigger this.","source":"NVD","date":"2026-10-09T05:16:44.407Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107888"],"cvss":{"score":5.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107888"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107888"}],"epss":null},{"id":"CVE-2026-107886","title":"CVE-2026-107886 — OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-","summary":"OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class member list, add_class() frees pclass->printers without clearing the pointer. If subsequent validation fails, the class retains the dangling pointer; CUPS-Delete-Class subsequently frees the same allocation in cupsdDeletePrinter(). A client authorized to modify and delete classes can cause scheduler-wide denial of service. The default policy requires @SYSTEM privileges.","source":"NVD","date":"2026-10-09T04:18:05.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107886"],"cvss":{"score":2.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107886"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107886"}],"epss":null},{"id":"CVE-2026-107885","title":"CVE-2026-107885 — OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout h","summary":"OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The scheduler suppresses timeout processing for all pending jobs whenever any client connection has an in-flight Send-Document operation, without matching that connection to the job being examined. A client allowed to reach the IPP service can hold an incomplete HTTP request containing parsed Send-Document headers before operation authorization, preventing unrelated incomplete jobs from expiring. Where Create-Job submission is allowed, incomplete jobs can accumulate until MaxJobs is exhausted and further legitimate print submissions are rejected. The suppression ends when the held connection closes.","source":"NVD","date":"2026-10-09T04:18:04.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107885"],"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107885"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107885"}],"epss":null},{"id":"https://www.securityweek.com/?p=49891","title":"Formula Predicts When AI Chatbots Are at Risk of Turning Bad","source":"SecurityWeek","date":"2026-10-09T04:12:38.000Z","summary":"Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted.  The post Formula Predicts When AI Chatbots Are at Risk of Turning Bad appeared first on SecurityWeek .","url":"https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49891"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/formula-predicts-when-ai-chatbots-are-at-risk-of-turning-bad/"}],"epss":null},{"id":"CVE-2026-97032","title":"CVE-2026-97032 — HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This ","summary":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","source":"NVD","date":"2026-10-08T23:17:06.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97032"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-97032"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032"}],"epss":null},{"id":"CVE-2026-97031","title":"CVE-2026-97031 — Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send","summary":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.","source":"NVD","date":"2026-10-08T23:17:06.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97031"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-97031"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031"}],"epss":null},{"id":"CVE-2026-97030","title":"CVE-2026-97030 — A trusted template author may have previously written a valid template wherein the use of the 'yield' key","summary":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.","source":"NVD","date":"2026-10-08T23:17:05.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97030"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-97030"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030"}],"epss":null},{"id":"CVE-2026-96207","title":"CVE-2026-96207 — Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate pr","summary":"Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.","source":"NVD","date":"2026-10-08T23:17:05.583Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96207","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-96207"],"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-96207"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96207"}],"epss":null},{"id":"CVE-2026-94510","title":"CVE-2026-94510 — Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to","summary":"Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.","source":"NVD","date":"2026-10-08T23:17:05.427Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94510","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94510"],"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94510"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94510"}],"epss":null},{"id":"CVE-2026-94448","title":"CVE-2026-94448 — When a JavaScript template literal contains consecutive expressions, the context tracking state was not p","summary":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.","source":"NVD","date":"2026-10-08T23:17:05.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94448"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-94448"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448"}],"epss":null},{"id":"CVE-2026-94447","title":"CVE-2026-94447 — Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain g","summary":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.","source":"NVD","date":"2026-10-08T23:17:05.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94447","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94447"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-94447"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94447"}],"epss":null},{"id":"CVE-2026-94444","title":"CVE-2026-94444 — Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and","summary":"Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.","source":"NVD","date":"2026-10-08T23:17:05.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94444","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94444"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-94444"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94444"}],"epss":null},{"id":"CVE-2026-94440","title":"CVE-2026-94440 — Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the ","summary":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.","source":"NVD","date":"2026-10-08T23:17:04.917Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94440"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94440"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440"}],"epss":null},{"id":"CVE-2026-94439","title":"CVE-2026-94439 — When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacki","summary":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.","source":"NVD","date":"2026-10-08T23:17:04.760Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94439"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94439"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439"}],"epss":null},{"id":"CVE-2026-88131","title":"CVE-2026-88131 — Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code ","summary":"Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.","source":"NVD","date":"2026-10-08T23:17:04.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88131","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88131"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-88131"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88131"}],"epss":null},{"id":"CVE-2026-83947","title":"CVE-2026-83947 — Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a networ","summary":"Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.","source":"NVD","date":"2026-10-08T23:17:04.423Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83947","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-83947"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-83947"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83947"}],"epss":null},{"id":"CVE-2026-83943","title":"CVE-2026-83943 — Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized att","summary":"Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.","source":"NVD","date":"2026-10-08T23:17:04.267Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83943","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-83943"],"cvss":{"score":8.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-83943"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83943"}],"epss":null},{"id":"CVE-2026-78669","title":"CVE-2026-78669 — A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large nu","summary":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","source":"NVD","date":"2026-10-08T23:17:04.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78669"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78669"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669"}],"epss":null},{"id":"CVE-2026-78667","title":"CVE-2026-78667 — When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ","summary":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.","source":"NVD","date":"2026-10-08T23:17:03.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78667"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78667"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667"}],"epss":null},{"id":"CVE-2026-78663","title":"CVE-2026-78663 — The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client re","summary":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","source":"NVD","date":"2026-10-08T23:17:03.647Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78663"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663"}],"epss":null},{"id":"CVE-2026-78660","title":"CVE-2026-78660 — Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementatio","summary":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","source":"NVD","date":"2026-10-08T23:17:03.510Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78660"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660"}],"epss":null},{"id":"CVE-2026-78659","title":"CVE-2026-78659 — When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populat","summary":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","source":"NVD","date":"2026-10-08T23:17:03.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-78659"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-78659"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659"}],"epss":null},{"id":"CVE-2026-77900","title":"CVE-2026-77900 — Missing authentication for critical function in Azure App Service allows an unauthorized attacker to exec","summary":"Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.","source":"NVD","date":"2026-10-08T23:17:03.107Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77900","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-77900"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-77900"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77900"}],"epss":null},{"id":"CVE-2026-69435","title":"CVE-2026-69435 — Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a netwo","summary":"Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.","source":"NVD","date":"2026-10-08T23:17:02.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69435","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-69435"],"cvss":{"score":9.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"secure@microsoft.com"},"read":false,"kev":false,"recordIds":["CVE-2026-69435"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69435"}],"epss":null},{"id":"CVE-2026-56866","title":"CVE-2026-56866 — When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body dir","summary":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.","source":"NVD","date":"2026-10-08T23:17:01.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-56866"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-56866"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866"}],"epss":null},{"id":"CVE-2026-56857","title":"CVE-2026-56857 — On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, t","summary":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).","source":"NVD","date":"2026-10-08T23:17:01.487Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-56857"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-56857"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857"}],"epss":null},{"id":"CVE-2026-107802","title":"CVE-2026-107802 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds ","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:17:00.320Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107802","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107802"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107802"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107802"}],"epss":null},{"id":"CVE-2026-107738","title":"CVE-2026-107738 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-c","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without a lower-bound check. An offset that becomes negative can make the function read before the /#STRINGS buffer, causing deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.970Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107738","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107738"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107738"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107738"}],"epss":null},{"id":"CVE-2026-107737","title":"CVE-2026-107737 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 whe","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl() accepts the signed host component of an its:// URL and FindHtmlWindowById() uses it directly as an index into gHtmlWindows. Opening a crafted CHM through the IE fallback backend with a negative or otherwise out-of-range window identifier can cause an out-of-bounds pointer read followed by an invalid object callback dereference and process termination. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.760Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107737","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107737"],"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107737"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107737"}],"epss":null},{"id":"CVE-2026-107736","title":"CVE-2026-107736 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to rea","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, MaybeFlipBitmap() asks GDI+ to read the attacker-controlled PropertyTagOrientation size through GetPropertyItem() while supplying only a fixed 64-byte buf on the stack. Opening a crafted TIFF with enough EXIF Orientation values can cause attacker-selected bytes to overwrite stack control data, while tested builds terminate through the stack cookie check. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.580Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107736","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107736"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107736"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107736"}],"epss":null},{"id":"CVE-2026-107735","title":"CVE-2026-107735 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the su","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, InitializePolicies() starts the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only ORs permission bits, so the INI file never revokes permissions. Deploying SumatraPDF with this INI file, including a malformed file or zero-valued permission settings, can silently bypass configured disk, network, printing, registry, clipboard, preference, and fullscreen restrictions. The -restrict command-line path works correctly and is not affected. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107735","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107735"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107735"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107735"}],"epss":null},{"id":"CVE-2026-107734","title":"CVE-2026-107734 — SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX sou","summary":"SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, an attacker-controlled SyncTeX source filename is substituted for the %f placeholder in an external editor command line without safe Windows argument quoting, and the resulting command line is passed to CreateProcessW(). A user with an external editor configured or auto-detected who opens a PDF with a crafted .synctex.gz file and invokes inverse search can inject command-line flags; the resulting impact depends on the target editor interpreting those flags and can include unintended editor actions or code execution through a malicious extension. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107734","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107734"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107734"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107734"}],"epss":null},{"id":"CVE-2026-107733","title":"CVE-2026-107733 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec b","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointer to RunWithExe(), which dereferences WindowTab::filePath. A local process in the same interactive Windows session, at an integrity level greater than or equal to SumatraPDF's under Windows UIPI, can dispatch CmdExec over DDE or WM_COPYDATA while no document tab is open, causing abrupt process termination and loss of unsaved state. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:59.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107733","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107733"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107733"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107733"}],"epss":null},{"id":"CVE-2026-107732","title":"CVE-2026-107732 — SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF l","summary":"SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, untrusted document paths and PDF link targets are interpolated into notification text that ParseTip() interprets as trusted tip markup. When a user clicks an injected link, ExecuteTipLink() dispatches its CmdExec command and can execute an attacker-selected local program in the user's context. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:58.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107732","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107732"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107732"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107732"}],"epss":null},{"id":"CVE-2026-107731","title":"CVE-2026-107731 — SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-valid","summary":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include contentOffset, the directory expression dirOff64 + dirLen64, and the decoded-section offset + size, along with secondary-header range handling. Opening a crafted LIT file that reaches one of these variants can cause invalid pointer reads and deterministic application termination. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:58.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107731","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107731"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107731"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107731"}],"epss":null},{"id":"CVE-2026-107730","title":"CVE-2026-107730 — SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp compu","summary":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader() in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces * 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation overflow to a negative value, pointer construction reaches an invalid read in LitU32(), causing deterministic application termination. The supplied evidence does not demonstrate code execution, information disclosure, arbitrary read, or integrity impact. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:58.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107730","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107730"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107730"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107730"}],"epss":null},{"id":"CVE-2026-107729","title":"CVE-2026-107729 — SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted un","summary":"SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, src/MobiDoc.cpp narrows the untrusted unsigned mobiHdr.hdrLen field to a signed integer for validation; values above INT_MAX become negative and bypass the upper-bound check. When the EXTH flag is set, the original unsigned value is reused as a pointer offset, causing DecodeExthHeader() to read beyond the record buffer. Opening a crafted MOBI file can reliably terminate the application with a native access violation; no code execution, information disclosure, or integrity impact has been demonstrated. No fixed version is available as of this review.","source":"NVD","date":"2026-10-08T23:16:58.350Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107729","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107729"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107729"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107729"}],"epss":null},{"id":"CVE-2026-107651","title":"CVE-2026-107651 — A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader du","summary":"A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exploit this flaw by enticing a user into opening a specially crafted PNG file, potentially leading to arbitrary code execution or a Denial of Service (DoS) via application crash.","source":"NVD","date":"2026-10-08T23:16:57.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107651","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107651"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107651"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107651"}],"epss":null},{"id":"CVE-2026-105674","title":"CVE-2026-105674 — TP-Link Tapo\nC325WB V2 generates the pre-shared key used by its local media streaming\nservice with a time","summary":"TP-Link Tapo\nC325WB V2 generates the pre-shared key used by its local media streaming\nservice with a time-seeded pseudo-random number generator, making the key\npredictable and recoverable. An unauthenticated attacker on the adjacent\nnetwork can recover the key and authenticate to the media streaming service\nwithout valid user credentials. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent-network attacker to access\nand take over live video and audio streams, compromising the confidentiality\nand integrity of camera media.","source":"NVD","date":"2026-10-08T23:16:57.663Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105674","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105674"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},"read":false,"kev":false,"recordIds":["CVE-2026-105674"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105674"}],"epss":null},{"id":"CVE-2026-105673","title":"CVE-2026-105673 — An\nunauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the\nRTSP streaming service","summary":"An\nunauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the\nRTSP streaming service on TCP port 554 when the Camera Account feature is\nenabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory\ncorruption and crash the streaming daemon. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent-network attacker to disrupt\nlive video and related streaming functions until the affected service recovers\nor restarts.","source":"NVD","date":"2026-10-08T23:16:57.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105673","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105673"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},"read":false,"kev":false,"recordIds":["CVE-2026-105673"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105673"}],"epss":null},{"id":"CVE-2026-105672","title":"CVE-2026-105672 — TP-Link Tapo\nC325WB V2 contains an unauthenticated authorization bypass vulnerability in the\nHTTPS JSON A","summary":"TP-Link Tapo\nC325WB V2 contains an unauthenticated authorization bypass vulnerability in the\nHTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network\ncan append an onboarding-scoped object to a JSON request to bypass session\nverification and invoke privileged actions without authentication. \n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated adjacent-network attacker to access\nlive video and audio, modify device settings, and obtain sensitive device\ninformation or secrets.","source":"NVD","date":"2026-10-08T23:16:57.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105672","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105672"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},"read":false,"kev":false,"recordIds":["CVE-2026-105672"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105672"}],"epss":null},{"id":"CVE-2026-100197","title":"CVE-2026-100197 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-08T23:16:56.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100197","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-100197"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-100197"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100197"}],"epss":null},{"id":"CVE-2026-89091","title":"CVE-2026-89091 — A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, ","summary":"A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.","source":"NVD","date":"2026-10-08T22:17:35.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89091"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-89091"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091"}],"epss":null},{"id":"CVE-2026-87980","title":"CVE-2026-87980 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive inform","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive information in logs.","source":"NVD","date":"2026-10-08T22:17:35.577Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87980","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87980"],"cvss":{"score":3.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87980"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87980"}],"epss":null},{"id":"CVE-2026-84891","title":"CVE-2026-84891 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive infor","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.","source":"NVD","date":"2026-10-08T22:17:34.573Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84891","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84891"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84891"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84891"}],"epss":null},{"id":"CVE-2026-84875","title":"CVE-2026-84875 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.","source":"NVD","date":"2026-10-08T22:17:34.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84875","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84875"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84875"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84875"}],"epss":null},{"id":"CVE-2026-84249","title":"CVE-2026-84249 — IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary manageme","summary":"IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.","source":"NVD","date":"2026-10-08T22:17:34.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84249","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84249"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84249"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84249"}],"epss":null},{"id":"CVE-2026-84247","title":"CVE-2026-84247 — IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of servic","summary":"IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.","source":"NVD","date":"2026-10-08T22:17:33.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84247","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84247"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84247"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84247"}],"epss":null},{"id":"CVE-2026-84246","title":"CVE-2026-84246 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.","source":"NVD","date":"2026-10-08T22:17:33.850Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84246","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84246"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84246"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84246"}],"epss":null},{"id":"CVE-2026-84230","title":"CVE-2026-84230 — IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a r","summary":"IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.","source":"NVD","date":"2026-10-08T22:17:33.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84230","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84230"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84230"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84230"}],"epss":null},{"id":"CVE-2026-84209","title":"CVE-2026-84209 — IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL comm","summary":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.","source":"NVD","date":"2026-10-08T22:17:33.583Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84209","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84209"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84209"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84209"}],"epss":null},{"id":"CVE-2026-84198","title":"CVE-2026-84198 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.","source":"NVD","date":"2026-10-08T22:17:33.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84198","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84198"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84198"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84198"}],"epss":null},{"id":"CVE-2026-84058","title":"CVE-2026-84058 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.","source":"NVD","date":"2026-10-08T22:17:33.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84058","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84058"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84058"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84058"}],"epss":null},{"id":"CVE-2026-84057","title":"CVE-2026-84057 — IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands","summary":"IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.","source":"NVD","date":"2026-10-08T22:17:33.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84057","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84057"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84057"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84057"}],"epss":null},{"id":"CVE-2026-84035","title":"CVE-2026-84035 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.","source":"NVD","date":"2026-10-08T22:17:33.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84035","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84035"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84035"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84035"}],"epss":null},{"id":"CVE-2026-84032","title":"CVE-2026-84032 — IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack d","summary":"IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation.","source":"NVD","date":"2026-10-08T22:17:32.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84032","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84032"],"cvss":{"score":5.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84032"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84032"}],"epss":null},{"id":"CVE-2026-82895","title":"CVE-2026-82895 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.","source":"NVD","date":"2026-10-08T22:17:32.627Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82895","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82895"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82895"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82895"}],"epss":null},{"id":"CVE-2026-81932","title":"CVE-2026-81932 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticate","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.","source":"NVD","date":"2026-10-08T22:17:32.493Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81932","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-81932"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-81932"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81932"}],"epss":null},{"id":"CVE-2026-80381","title":"CVE-2026-80381 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized S","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.","source":"NVD","date":"2026-10-08T22:17:32.353Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80381","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-80381"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-80381"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80381"}],"epss":null},{"id":"CVE-2026-75875","title":"CVE-2026-75875 — IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code","summary":"IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.","source":"NVD","date":"2026-10-08T22:17:32.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75875","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-75875"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-75875"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75875"}],"epss":null},{"id":"CVE-2026-107831","title":"CVE-2026-107831 — Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to ","summary":"Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by abusing GET endpoints lacking anti-CSRF tokens. Attackers can lure authenticated users to crafted links targeting /account/protected/delAll, /account/protected/sub/delSub, or /message/updateAction to delete private messages and subscriptions or rename threads.","source":"NVD","date":"2026-10-08T22:17:30.947Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107831","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107831"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107831"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107831"}],"epss":null},{"id":"CVE-2026-107830","title":"CVE-2026-107830 — Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account","summary":"Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance.","source":"NVD","date":"2026-10-08T22:17:30.797Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107830","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107830"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107830"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107830"}],"epss":null},{"id":"CVE-2026-107829","title":"CVE-2026-107829 — Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsa","summary":"Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.","source":"NVD","date":"2026-10-08T22:17:30.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107829","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107829"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107829"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107829"}],"epss":null},{"id":"CVE-2026-107828","title":"CVE-2026-107828 — Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attacker","summary":"Jivejdon through 5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access Weibo-created accounts by deriving predictable credentials from public Weibo user IDs. OAuthAccountServiceImp.transferSina() sets the password to the first four digits of the Weibo ID, letting attackers log in through normal form login to read or post as victims.","source":"NVD","date":"2026-10-08T22:17:30.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107828","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107828"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107828"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107828"}],"epss":null},{"id":"CVE-2026-107801","title":"CVE-2026-107801 — Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attac","summary":"Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments with an attacker-supplied Content-Type. Attackers can upload a file declared as text/html, which UploadShowAction serves inline, and share its link to run JavaScript on the application's origin for viewing users.","source":"NVD","date":"2026-10-08T22:17:30.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107801","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107801"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107801"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107801"}],"epss":null},{"id":"CVE-2026-107800","title":"CVE-2026-107800 — Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attac","summary":"Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages because receiveshortmessage.jsp renders unfiltered message bodies. Attackers can send a short message containing script, which ToolsUtil.convertURL() passes through unchanged, to execute code in the recipient's browser when opened.","source":"NVD","date":"2026-10-08T22:17:30.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107800","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107800"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107800"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107800"}],"epss":null},{"id":"CVE-2026-107799","title":"CVE-2026-107799 — Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attac","summary":"Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter=\"false\" and non-escaping default filters, executing script in the browser of every user viewing the thread.","source":"NVD","date":"2026-10-08T22:17:30.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107799","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107799"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107799"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107799"}],"epss":null},{"id":"CVE-2026-107798","title":"CVE-2026-107798 — jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerabilit","summary":"jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.","source":"NVD","date":"2026-10-08T22:17:29.887Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107798","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107798"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107798"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107798"}],"epss":null},{"id":"CVE-2026-107797","title":"CVE-2026-107797 — Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postT","summary":"Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via the to and tag parameters. Attackers can send crafted links to authenticated users, breaking out of unencoded inline JavaScript string literals to execute arbitrary JavaScript in the victim's session.","source":"NVD","date":"2026-10-08T22:17:29.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107797","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107797"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107797"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107797"}],"epss":null},{"id":"CVE-2026-107796","title":"CVE-2026-107796 — Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerabi","summary":"Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that allows unauthenticated attackers to inject script via unencoded tagID and count parameters. Attackers can craft a link with a script-closing payload in tagID or count, triggered when start exceeds zero, to execute JavaScript in victims' browsers.","source":"NVD","date":"2026-10-08T22:17:29.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107796","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107796"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107796"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107796"}],"epss":null},{"id":"CVE-2026-107793","title":"CVE-2026-107793 — Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubsc","summary":"Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveAction with another user's subscriptionId to remove their thread, forum, tag or account subscriptions.","source":"NVD","date":"2026-10-08T22:17:29.443Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107793","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107793"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107793"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107793"}],"epss":null},{"id":"CVE-2026-107792","title":"CVE-2026-107792 — Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in U","summary":"Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authorization vulnerability in UpdateThreadToForumAction that allows authenticated users to move other users' threads. Attackers can send crafted threadId and forumId values to /message/threadToForum/save to relocate any reply-less thread into an arbitrary forum.","source":"NVD","date":"2026-10-08T22:17:29.293Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107792","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107792"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107792"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107792"}],"epss":null},{"id":"CVE-2026-107726","title":"CVE-2026-107726 — Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior ","summary":"Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluster allows arbitrary reads from a cluster member's Java heap, off-heap data, and JVM process address space. The same flaw can crash cluster members and, in some Hazelcast Enterprise Edition configurations, corrupt memory with possible arbitrary code execution. Both slim and full distributions are affected. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.","source":"NVD","date":"2026-10-08T22:17:29.120Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107726","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107726","GHSA-6V25-8WQ6-XQ4J"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107726","GHSA-6v25-8wq6-xq4j"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107726"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6v25-8wq6-xq4j"}],"epss":{"score":0.00383,"date":"2026-10-12","percentile":0.30403}},{"id":"CVE-2026-107725","title":"CVE-2026-107725 — Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior ","summary":"Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, missing authorization checks in the IMap Predicates API allow a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member. This issue is fixed in versions 5.4.5, 5.5.10, 5.6.1, and 5.7.0.","source":"NVD","date":"2026-10-08T22:17:28.967Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107725","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107725","GHSA-W294-6Q5Q-53P8"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107725","GHSA-w294-6q5q-53p8"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107725"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w294-6q5q-53p8"}],"epss":{"score":0.00385,"date":"2026-10-12","percentile":0.30589}},{"id":"CVE-2026-107724","title":"CVE-2026-107724 — fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialize","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.2.4, fast-jwt can classify raw serialized public JWK or JWKS JSON as an HMAC secret because src/crypto.js performDetectPublicKeyAlgorithms treats non-PEM strings as symmetric key material. If HS256 is explicitly allowed or inferred, an attacker who knows the exact serialized public-key bytes can use those bytes as an HMAC key and create a token containing arbitrary claims that createVerifier accepts. Serialization ordering or whitespace differences can prevent exploitation, and applications using supported PEM keys with an asymmetric-only algorithm allowlist are not affected. This issue is fixed in version 6.3.0.","source":"NVD","date":"2026-10-08T22:17:28.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107724","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107724","GHSA-G3JJ-5CMM-3HXX"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107724","GHSA-g3jj-5cmm-3hxx"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107724"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-g3jj-5cmm-3hxx"}],"epss":{"score":0.00222,"date":"2026-10-12","percentile":0.1174}},{"id":"CVE-2026-107723","title":"CVE-2026-107723 — fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accep","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose payload is a JSON array because src/decoder.js checks that the payload is an object but does not reject arrays. The claim validator loop then finds no named exp, nbf, iss, aud, sub, jti, or nonce properties and silently skips those configured checks, returning the array as a successfully verified payload. An attacker who can produce or influence a validly signed token may bypass expiry, issuer, audience, subject, revocation, and replay protections. The opt-in requiredClaims option can block missing claims, and signature verification itself is not bypassed. This issue is fixed in version 6.3.0.","source":"NVD","date":"2026-10-08T22:17:28.623Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107723","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107723","GHSA-5HJW-83FP-PHQ9"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107723","GHSA-5hjw-83fp-phq9"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107723"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5hjw-83fp-phq9"}],"epss":{"score":0.00358,"date":"2026-10-12","percentile":0.27655}},{"id":"CVE-2026-107722","title":"CVE-2026-107722 — fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclass","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/crypto.js, performDetectPublicKeyAlgorithms trims whitespace but publicKeyPemMatcher remains start-anchored, so comments, control characters, zero-width characters, or wrapper text can prevent PEM detection and reach the HMAC fallback. An attacker who knows the public key bytes can sign arbitrary HS256 claims with that public material when HS256 is inferred or allowed, resulting in authentication or authorization bypass. An asymmetric-only algorithm allowlist prevents the attack. This issue is fixed in version 6.3.0.","source":"NVD","date":"2026-10-08T22:17:28.447Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107722","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107722","GHSA-WW5H-9M49-7XX4"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107722","GHSA-ww5h-9m49-7xx4"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107722"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-ww5h-9m49-7xx4"}],"epss":{"score":0.00272,"date":"2026-10-12","percentile":0.18038}},{"id":"CVE-2026-107721","title":"CVE-2026-107721 — fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accep","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf comparisons always pass, allowing expired or not-yet-active tokens to be accepted. The verifier cache also derives infinite bounds, so entries created under this configuration can remain valid until eviction. Exploitation requires an application administrator or equivalent configuration path to set clockTolerance to Infinity. This issue is fixed in version 6.3.0.","source":"NVD","date":"2026-10-08T22:17:28.263Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107721","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107721","GHSA-687G-22H4-J4W4"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107721","GHSA-687g-22h4-j4w4"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107721"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-687g-22h4-j4w4"}],"epss":{"score":0.00334,"date":"2026-10-12","percentile":0.24909}},{"id":"CVE-2026-107720","title":"CVE-2026-107720 — fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accep","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.1, fast-jwt createVerifier accepts an unsigned JWT when key is an empty string or null and algorithms is a non-empty allowlist. Falsy synchronous keys bypass prepareKeyOrSecret, allowedAlgorithms remains active, hasKey is false, and the empty signature avoids the verifySignature gate. An attacker can therefore submit a token containing arbitrary claims without possessing a signing key, resulting in authentication or authorization bypass. Claim validators still run, and non-empty keys, an empty key without algorithms, and the async key resolver path do not have this behavior. This issue is fixed in version 6.3.1.","source":"NVD","date":"2026-10-08T22:17:28.090Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107720","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107720","GHSA-8WPC-H4Q6-8FXV"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107720","GHSA-8wpc-h4q6-8fxv"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107720"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8wpc-h4q6-8fxv"}],"epss":{"score":0.00256,"date":"2026-10-12","percentile":0.15916}},{"id":"CVE-2026-107719","title":"CVE-2026-107719 — fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier c","summary":"fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadline only when iat is present, so the cache falls back to cacheTTL, and a later cache hit returns the saved payload before verifyToken rechecks expiration. An attacker who can replay the same cached bearer token can extend access until the cache entry expires, but cannot forge a token through this issue. This issue is fixed in version 6.3.4.","source":"NVD","date":"2026-10-08T22:17:27.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107719","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107719","GHSA-X937-HJ6V-793P"],"cvss":{"score":4.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107719","GHSA-x937-hj6v-793p"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107719"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x937-hj6v-793p"}],"epss":{"score":0.00226,"date":"2026-10-12","percentile":0.1228}},{"id":"CVE-2026-107718","title":"CVE-2026-107718 — AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 an","summary":"AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and ","source":"NVD","date":"2026-10-08T22:17:27.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107718","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107718","GHSA-2M6Q-8V3H-JQWW"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107718","GHSA-2m6q-8v3h-jqww"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107718"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2m6q-8v3h-jqww"}],"epss":{"score":0.00278,"date":"2026-10-12","percentile":0.18702}},{"id":"CVE-2026-107717","title":"CVE-2026-107717 — Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.cha","summary":"Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.0, Banks Prompt.chat_messages() attempts to parse every line of rendered template output as ChatMessage JSON. When an application renders untrusted data and passes the returned ChatMessage objects to an LLM provider, attacker-controlled JSON can cross the prompt boundary and become a system, assistant, or tool message because ChatMessage.role accepts arbitrary strings. This can override application instructions, alter the intended prompt structure, or confuse downstream tool and message handling. This issue is fixed in version 2.5.0.","source":"NVD","date":"2026-10-08T22:17:27.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107717","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107717","GHSA-HMQ2-7HP6-7CRH"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107717","GHSA-hmq2-7hp6-7crh"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107717"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-hmq2-7hp6-7crh"}],"epss":{"score":0.00279,"date":"2026-10-12","percentile":0.18776}},{"id":"CVE-2026-107716","title":"CVE-2026-107716 — Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryP","summary":"Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.","source":"NVD","date":"2026-10-08T22:17:27.323Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107716","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107716","GHSA-556J-VV39-8RQV"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107716","GHSA-556j-vv39-8rqv"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107716"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-556j-vv39-8rqv"}],"epss":{"score":0.00134,"date":"2026-10-12","percentile":0.02529}},{"id":"CVE-2026-107715","title":"CVE-2026-107715 — The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends ","summary":"The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers, and the protected header lists omit Proxy-Authorization and Cookie2. An attacker who controls a redirect target can capture bearer tokens or session cookies supplied through request_headers= or the per-request headers argument, while Mechanize#cookie_jar and Mechanize::HTTP::AuthStore are not affected. This issue is fixed in version 2.14.1.","source":"NVD","date":"2026-10-08T22:17:27.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107715","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107715","GHSA-2MWR-XJCG-37J7"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107715","GHSA-2mwr-xjcg-37j7"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107715"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2mwr-xjcg-37j7"}],"epss":{"score":0.00395,"date":"2026-10-12","percentile":0.317}},{"id":"CVE-2026-107714","title":"CVE-2026-107714 — The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP:","summary":"The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redirect to another port can send a caller-supplied Cookie header to a different service. Cookies in Mechanize#cookie_jar remain scoped separately; the issue affects caller-supplied headers and can disclose credentials without affecting integrity or availability. This issue is fixed in version 2.14.1.","source":"NVD","date":"2026-10-08T22:17:27.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107714","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107714"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107714"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107714"}],"epss":null},{"id":"CVE-2026-107406","title":"CVE-2026-107406 — Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetS","summary":"Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC.\n\n\nNetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:\n\n\n\n \n\n  *  For the following versions: Applicable only when configured as a SAML IdP:\n  *  NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive\n  *  NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive\n  *  NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive\n  *  NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive\n\n\n\n\n \n\n\n\nFor the following versions: Applicable only when configured as a SAML SP or SAML IdP:\n\n  *  NetScaler ADC and NetScaler Gateway before 14.1-73.37 \n  *  NetSc","source":"NVD","date":"2026-10-08T22:17:26.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107406","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107406"],"cvss":{"score":9.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5"},"read":false,"kev":false,"recordIds":["CVE-2026-107406"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107406"}],"epss":null},{"id":"CVE-2026-107399","title":"CVE-2026-107399 — The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applie","summary":"The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.","source":"NVD","date":"2026-10-08T22:17:26.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107399","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107399","GHSA-C6RP-P8XM-4Q9F"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107399","GHSA-c6rp-p8xm-4q9f"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107399"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c6rp-p8xm-4q9f"}],"epss":{"score":0.00362,"date":"2026-10-12","percentile":0.28155}},{"id":"CVE-2026-105275","title":"CVE-2026-105275 — Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data ","summary":"Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files exist on the host system.","source":"NVD","date":"2026-10-08T22:17:26.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105275","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105275"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-105275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105275"}],"epss":null},{"id":"CVE-2026-105269","title":"CVE-2026-105269 — Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An auth","summary":"Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.","source":"NVD","date":"2026-10-08T22:17:26.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105269","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105269"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-105269"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105269"}],"epss":null},{"id":"CVE-2026-104628","title":"CVE-2026-104628 — Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnera","summary":"Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading the availability of the application.","source":"NVD","date":"2026-10-08T22:17:26.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104628","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104628"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-104628"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104628"}],"epss":null},{"id":"CVE-2025-71428","title":"CVE-2025-71428 — Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that ","summary":"Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.","source":"NVD","date":"2026-10-08T22:17:26.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71428","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2025-71428"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2025-71428"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71428"}],"epss":null},{"id":"CVE-2026-107394","title":"Indico: Incomplete Server-Side Request Forgery (SSRF) check","source":"GitHub Advisories","date":"2026-10-08T22:09:55Z","summary":"### Impact Indico makes outgoing requests to user-provides URLs in various places.  This is mostly intentional and part of Indico's functionality, but of course it is never intended to let you access \"special\" targets such as localhost or cloud metadata endpoints.","url":"https://github.com/advisories/GHSA-2v95-h47v-g4x9","topic":"Code & supply chain","read":false,"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107394","GHSA-2V95-H47V-G4X9"],"kev":false,"recordIds":["GHSA-2v95-h47v-g4x9","CVE-2026-107394"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2v95-h47v-g4x9"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107394"}],"epss":{"score":0.00339,"date":"2026-10-12","percentile":0.25421}},{"id":"CVE-2026-107395","title":"Indico: Missing access check in legacy session export API","source":"GitHub Advisories","date":"2026-10-08T22:09:49Z","summary":"### Impact A legacy API to retrieve session details could be misused to retrieve metadata (such as title, description and conveners) of a restricted session within without having access to that session, as long as the event itself was accessible.  13) as soon as possible.","url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q","topic":"Code & supply chain","read":false,"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107395","GHSA-6P4F-J8J6-463Q"],"kev":false,"recordIds":["GHSA-6p4f-j8j6-463q","CVE-2026-107395"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6p4f-j8j6-463q"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107395"}],"epss":{"score":0.00235,"date":"2026-10-12","percentile":0.13235}},{"id":"CVE-2026-107397","title":"Indico: Cross-Site-Scripting in minutes editor","source":"GitHub Advisories","date":"2026-10-08T22:09:45Z","summary":"### Impact There is a Cross-Site-Scripting vulnerability in the minute editor conflict UI tha's shown when concurrent edits are made to the same minutes in an event.  13) as soon as possible.","url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q","topic":"Code & supply chain","read":false,"cvss":{"score":4.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107397","GHSA-CW24-X4MJ-FW3Q"],"kev":false,"recordIds":["GHSA-cw24-x4mj-fw3q","CVE-2026-107397"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cw24-x4mj-fw3q"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107397"}],"epss":{"score":0.00233,"date":"2026-10-12","percentile":0.1305}},{"id":"CVE-2026-107396","title":"Indico: Cross-Site-Scripting in link fields","source":"GitHub Advisories","date":"2026-10-08T22:09:41Z","summary":"### Impact There is a Cross-Site-Scripting vulnerability in fields that allow entering custom URLs.  13) as soon as possible.","url":"https://github.com/advisories/GHSA-c4wc-ggrj-jg9v","topic":"Code & supply chain","read":false,"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107396","GHSA-C4WC-GGRJ-JG9V"],"kev":false,"recordIds":["GHSA-c4wc-ggrj-jg9v","CVE-2026-107396"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c4wc-ggrj-jg9v"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107396"}],"epss":{"score":0.00195,"date":"2026-10-12","percentile":0.08468}},{"id":"CVE-2026-61426","title":"PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure","source":"GitHub Advisories","date":"2026-10-08T22:01:29Z","summary":"0`, sets no API key, and uses CORS `*` with credentials.  e.","url":"https://github.com/advisories/GHSA-6wjp-v33h-5cvq","topic":"Code & supply chain","read":false,"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-61426","GHSA-6WJP-V33H-5CVQ"],"kev":false,"recordIds":["GHSA-6wjp-v33h-5cvq"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6wjp-v33h-5cvq"}],"epss":{"score":0.00478,"date":"2026-10-12","percentile":0.39439}},{"id":"CVE-2026-61442","title":"PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass","source":"GitHub Advisories","date":"2026-10-08T22:01:11Z","summary":"# Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass ## Summary `praisonai-platform` lets an ordinary workspace member patch owner-created project, issue, and agent records even though the paired delete routes enforce owner/admin authorization.  For projects, the member can first patch `lead_id` to their own user id and then delete the owner-created project, bypassing a delete guard that correctly returned `403` before the reassignment.","url":"https://github.com/advisories/GHSA-c78w-2q4r-68r7","topic":"Code & supply chain","read":false,"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-61442","GHSA-C78W-2Q4R-68R7"],"kev":false,"recordIds":["GHSA-c78w-2q4r-68r7"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c78w-2q4r-68r7"}],"epss":{"score":0.00457,"date":"2026-10-12","percentile":0.37796}},{"id":"CVE-2026-61434","title":"PraisonAI: Shell command allowlist bypass via find -exec built-in action","source":"GitHub Advisories","date":"2026-10-08T22:00:55Z","summary":"58 to fix GHSA-5jv7-2mjm-h6qj (utility-tools shell chaining) and GHSA-vjv9-7m7j-h833 (SandboxExecutor chaining) can be bypassed via `find`'s built-in `-exec` action.  The fix blocks shell metacharacters (`` ;|&`> {} + ``` The `+` terminator (batch mode) avoids `;` which IS blocked by the metacharacter regex.","url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-61434","GHSA-CV3G-HJ65-PCFH"],"kev":false,"recordIds":["GHSA-cv3g-hj65-pcfh"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cv3g-hj65-pcfh"}],"epss":{"score":0.00877,"date":"2026-10-12","percentile":0.57895}},{"id":"CVE-2026-61445","title":"PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls","source":"GitHub Advisories","date":"2026-10-08T22:00:40Z","summary":"### Summary The `AICoder` UI component exposes `write_to_file` and `execute_command` tools to the LLM with no path validation and no command sanitization.  ssh/authorized_keys`, `/etc/crontab`) and arbitrary command execution through prompt injection in the chat interface.","url":"https://github.com/advisories/GHSA-9mp3-24cc-77mg","topic":"Code & supply chain","read":false,"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-61445","GHSA-9MP3-24CC-77MG"],"kev":false,"recordIds":["GHSA-9mp3-24cc-77mg"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9mp3-24cc-77mg"}],"epss":{"score":0.00881,"date":"2026-10-12","percentile":0.58002}},{"id":"CVE-2026-61427","title":"PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface","source":"GitHub Advisories","date":"2026-10-08T21:58:42Z","summary":"## Summary PraisonAI's MCP HTTP-stream server authenticates requests only when an API key is configured; the CLI defaults `--api-key` to `None`, so `praisonai mcp serve --transport http-stream` exposes the full MCP surface unauthenticated.  A request with no `Authorization` (and no `Origin`) can `initialize` and `tools/list` (~50 tools), and the dispatcher forwards tool-call arguments to handlers without validating them against the advertised `inputSchema`.","url":"https://github.com/advisories/GHSA-hc5v-gxvj-58wh","topic":"Code & supply chain","read":false,"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-61427","GHSA-HC5V-GXVJ-58WH"],"kev":false,"recordIds":["GHSA-hc5v-gxvj-58wh"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-hc5v-gxvj-58wh"}],"epss":{"score":0.00389,"date":"2026-10-12","percentile":0.31007}},{"id":"CVE-2026-61440","title":"PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization","source":"GitHub Advisories","date":"2026-10-08T21:58:27Z","summary":"# Platform members can rewrite shared labels and owner issue labels without owner/admin authorization ## Summary `praisonai-platform` lets an ordinary workspace member rename and recolor shared labels and add/remove labels on an owner-created issue even though direct label deletion is restricted to workspace admin/owner authority in current releases.  ## Technical Details The affected boundary is the difference between ordinary workspace membership and authority to mutate shared workspace triage taxonomy or owner-created issue workflow state.","url":"https://github.com/advisories/GHSA-xxgv-vgvj-qvxh","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61440","GHSA-XXGV-VGVJ-QVXH"],"kev":false,"recordIds":["GHSA-xxgv-vgvj-qvxh"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-xxgv-vgvj-qvxh"}],"epss":{"score":0.00376,"date":"2026-10-12","percentile":0.29599}},{"id":"CVE-2026-60085","title":"PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend","source":"GitHub Advisories","date":"2026-10-08T21:58:11Z","summary":"py is a documented configuration data class with fields for allow_subprocess, allowed_paths, blocked_paths, allowed_commands, blocked_commands, allowed_imports, and blocked_imports.  config) and blocked_commands (rm -rf, dd, mkfs, fdisk, shutdown, reboot).","url":"https://github.com/advisories/GHSA-5r6c-gj4g-r697","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-60085","GHSA-5R6C-GJ4G-R697"],"kev":false,"recordIds":["GHSA-5r6c-gj4g-r697"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5r6c-gj4g-r697"}],"epss":{"score":0.00255,"date":"2026-10-12","percentile":0.15805}},{"id":"CVE-2026-60091","title":"PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF","source":"GitHub Advisories","date":"2026-10-08T21:57:57Z","summary":"## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so by default every endpoint is unauthenticated.  An unauthenticated `POST /api/v1/runs` accepts an attacker-controlled `webhook_url`; on job completion the server POSTs the job payload to it via `httpx`.","url":"https://github.com/advisories/GHSA-4w49-gwv8-fpjg","topic":"Code & supply chain","read":false,"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-60091","GHSA-4W49-GWV8-FPJG"],"kev":false,"recordIds":["GHSA-4w49-gwv8-fpjg"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4w49-gwv8-fpjg"}],"epss":{"score":0.00301,"date":"2026-10-12","percentile":0.21048}},{"id":"https://cyberscoop.com/?p=91047","title":"Leader of 764 pleads guilty, faces up to 30 years in prison","source":"CyberScoop","date":"2026-10-08T21:41:53.000Z","summary":"Prasan Nepal ran the nihilistic violent extremist network for almost four years and played a crucial role facilitating the grooming, manipulation and extortion of minors.  The post Leader of 764 pleads guilty, faces up to 30 years in prison appeared first on CyberScoop .","url":"https://cyberscoop.com/764-leader-prasan-nepal-guilty/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91047"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/764-leader-prasan-nepal-guilty/"}],"epss":null},{"id":"https://cyberscoop.com/?p=91043","title":"Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software","source":"CyberScoop","date":"2026-10-08T21:32:40.000Z","summary":"The critical infrastructure defense program will seek to pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies.  The post Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software appeared first on CyberScoop .","url":"https://cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91043"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/anthropic-cybersecurity-program-critical-infrastructure-open-source/"}],"epss":null},{"id":"CVE-2026-95116","title":"CVE-2026-95116 — An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_f","summary":"An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.","source":"NVD","date":"2026-10-08T21:18:03.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95116","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95116"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-95116"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95116"}],"epss":null},{"id":"CVE-2026-79842","title":"CVE-2026-79842 — An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0","summary":"An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713","source":"NVD","date":"2026-10-08T21:18:03.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79842","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-79842"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"security-alert@hpe.com"},"read":false,"kev":false,"recordIds":["CVE-2026-79842"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79842"}],"epss":null},{"id":"CVE-2026-78407","title":"CVE-2026-78407 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are v","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-08T21:18:03.330Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78407","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-78407"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78407"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78407"}],"epss":null},{"id":"CVE-2026-78406","title":"CVE-2026-78406 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.","source":"NVD","date":"2026-10-08T21:18:03.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78406","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-78406"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78406"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78406"}],"epss":null},{"id":"CVE-2026-78399","title":"CVE-2026-78399 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources","source":"NVD","date":"2026-10-08T21:18:02.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78399","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-78399"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-78399"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78399"}],"epss":null},{"id":"CVE-2026-78388","title":"CVE-2026-78388 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vu","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.","source":"NVD","date":"2026-10-08T21:18:02.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78388","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-78388"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-78388"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78388"}],"epss":null},{"id":"CVE-2026-62181","title":"CVE-2026-62181 — Rejected reason: This CVE is a duplicate of another CVE.","summary":"Rejected reason: This CVE is a duplicate of another CVE.","source":"NVD","date":"2026-10-08T21:18:01.733Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62181","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62181"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62181"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62181"}],"epss":null},{"id":"CVE-2026-19878","title":"CVE-2026-19878 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass additional authentication workflow steps.","source":"NVD","date":"2026-10-08T21:17:57.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19878","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-19878"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-19878"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19878"}],"epss":null},{"id":"CVE-2026-19498","title":"CVE-2026-19498 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.","source":"NVD","date":"2026-10-08T21:17:57.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19498","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-19498"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-19498"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19498"}],"epss":null},{"id":"CVE-2026-19493","title":"CVE-2026-19493 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal.","source":"NVD","date":"2026-10-08T21:17:57.203Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19493","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-19493"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19493"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19493"}],"epss":null},{"id":"CVE-2026-19482","title":"CVE-2026-19482 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.","source":"NVD","date":"2026-10-08T21:17:56.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19482","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-19482"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19482"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19482"}],"epss":null},{"id":"CVE-2026-18740","title":"CVE-2026-18740 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.","source":"NVD","date":"2026-10-08T21:17:56.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18740","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-18740"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-18740"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18740"}],"epss":null},{"id":"CVE-2026-17189","title":"CVE-2026-17189 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vu","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session","source":"NVD","date":"2026-10-08T21:17:56.633Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17189","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-17189"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-17189"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17189"}],"epss":null},{"id":"CVE-2026-16830","title":"CVE-2026-16830 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.","source":"NVD","date":"2026-10-08T21:17:56.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16830","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-16830"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16830"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16830"}],"epss":null},{"id":"CVE-2026-16823","title":"CVE-2026-16823 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.","source":"NVD","date":"2026-10-08T21:17:56.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16823","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-16823"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-16823"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16823"}],"epss":null},{"id":"CVE-2026-12091","title":"CVE-2026-12091 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.","source":"NVD","date":"2026-10-08T21:17:54.937Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12091","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-12091"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-12091"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12091"}],"epss":null},{"id":"CVE-2026-11939","title":"CVE-2026-11939 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may b","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may be vulnerable to audit log forgery.","source":"NVD","date":"2026-10-08T21:17:54.803Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11939","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-11939"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-11939"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11939"}],"epss":null},{"id":"CVE-2026-11936","title":"CVE-2026-11936 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-08T21:17:54.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11936","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-11936"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-11936"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11936"}],"epss":null},{"id":"CVE-2026-11930","title":"CVE-2026-11930 — IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may n","summary":"IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 may not enforce authorization correctly for some web servers.","source":"NVD","date":"2026-10-08T21:17:54.523Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11930","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"security_verify_access"},{"vendor":"ibm","product":"security_verify_access_container"},{"vendor":"ibm","product":"verify_identity_access"},{"vendor":"ibm","product":"verify_identity_access_container"}],"aliases":["CVE-2026-11930"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-11930"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11930"}],"epss":null},{"id":"CVE-2026-11318","title":"CVE-2026-11318 — Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer ","summary":"Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the macOS host.","source":"NVD","date":"2026-10-08T21:17:53.377Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11318","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-11318"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-11318"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11318"}],"epss":null},{"id":"CVE-2026-107782","title":"CVE-2026-107782 — System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helpe","summary":"System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.","source":"NVD","date":"2026-10-08T21:17:53.227Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107782","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107782"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107782"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107782"}],"epss":null},{"id":"CVE-2026-107781","title":"CVE-2026-107781 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request for","summary":"Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missing authorization vulnerability in the OnlyOffice save callback editUploadOfficeFileById. Unauthenticated attackers can supply arbitrary url and key parameters to make the server fetch internal URLs and overwrite any user's stored file, then read results via queryFileToShowById.","source":"NVD","date":"2026-10-08T21:17:53.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107781","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107781"],"cvss":{"score":9.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107781"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107781"}],"epss":null},{"id":"CVE-2026-107780","title":"CVE-2026-107780 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection v","summary":"Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.","source":"NVD","date":"2026-10-08T21:17:52.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107780","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107780"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107780"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107780"}],"epss":null},{"id":"CVE-2026-107779","title":"CVE-2026-107779 — Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication ","summary":"Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor host or stopping and deleting jobs.","source":"NVD","date":"2026-10-08T21:17:52.790Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107779","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107779"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107779"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107779"}],"epss":null},{"id":"CVE-2026-107778","title":"CVE-2026-107778 — MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c","summary":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.","source":"NVD","date":"2026-10-08T21:17:52.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107778"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107778"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778"}],"epss":null},{"id":"CVE-2026-107708","title":"CVE-2026-107708 — MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with","summary":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.","source":"NVD","date":"2026-10-08T21:17:52.223Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107708"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107708"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708"}],"epss":null},{"id":"CVE-2026-107318","title":"CVE-2026-107318 — @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In ve","summary":"@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.","source":"NVD","date":"2026-10-08T21:17:51.807Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107318","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107318"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},"read":false,"kev":false,"recordIds":["CVE-2026-107318"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107318"}],"epss":null},{"id":"CVE-2026-106435","title":"CVE-2026-106435 — The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malf","summary":"The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decode_all API can cause the application process to terminate when the C extension is loaded. The driver's normal database wire-protocol path does not reach this code.","source":"NVD","date":"2026-10-08T21:17:51.667Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106435","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106435"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106435"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106435"}],"epss":null},{"id":"CVE-2026-102368","title":"CVE-2026-102368 — Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolati","summary":"Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. \n\nSuccessful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.","source":"NVD","date":"2026-10-08T21:17:51.397Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102368","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102368"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},"read":false,"kev":false,"recordIds":["CVE-2026-102368"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102368"}],"epss":null},{"id":"CVE-2026-101024","title":"CVE-2026-101024 — Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data ","summary":"Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitation could result in unauthorized file creation or modification and, under certain conditions, arbitrary code execution.","source":"NVD","date":"2026-10-08T21:17:51.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101024","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101024"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-101024"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101024"}],"epss":null},{"id":"CVE-2026-84275","title":"CVE-2026-84275 — IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. A","summary":"IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.","source":"NVD","date":"2026-10-08T20:17:38.077Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84275","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84275"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-84275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84275"}],"epss":null},{"id":"CVE-2026-84274","title":"CVE-2026-84274 — IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During","summary":"IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material is logged at INFO level by the edge-controller/edge-manager components. An authenticated attacker with access to the relevant application or container logs could obtain these credentials and use them to impersonate services or gain unauthorized access to the Guardium control plane.","source":"NVD","date":"2026-10-08T20:17:37.927Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84274","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84274"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84274"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84274"}],"epss":null},{"id":"CVE-2026-84271","title":"CVE-2026-84271 — IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer","summary":"IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.","source":"NVD","date":"2026-10-08T20:17:37.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84271","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84271"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84271"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84271"}],"epss":null},{"id":"CVE-2026-84250","title":"CVE-2026-84250 — IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded rec","summary":"IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.","source":"NVD","date":"2026-10-08T20:17:37.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84250","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84250"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-84250"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84250"}],"epss":null},{"id":"CVE-2026-84245","title":"CVE-2026-84245 — IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper compone","summary":"IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.","source":"NVD","date":"2026-10-08T20:17:37.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84245","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84245"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84245"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84245"}],"epss":null},{"id":"CVE-2026-84244","title":"CVE-2026-84244 — IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-sit","summary":"IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.","source":"NVD","date":"2026-10-08T20:17:37.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84244","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84244"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-84244"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84244"}],"epss":null},{"id":"CVE-2026-82344","title":"CVE-2026-82344 — IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP Traffi","summary":"IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.","source":"NVD","date":"2026-10-08T20:17:37.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82344","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"},{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-82344"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-82344"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82344"}],"epss":null},{"id":"CVE-2026-82335","title":"CVE-2026-82335 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoD","summary":"IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.","source":"NVD","date":"2026-10-08T20:17:36.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82335","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"},{"vendor":"ibm","product":"guardium_data_protection"},{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-82335"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-82335"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82335"}],"epss":null},{"id":"CVE-2026-82334","title":"CVE-2026-82334 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS","summary":"IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.","source":"NVD","date":"2026-10-08T20:17:36.737Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82334","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"},{"vendor":"ibm","product":"guardium_data_protection"},{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-82334"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","source":"nvd@nist.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-82334"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82334"}],"epss":null},{"id":"CVE-2026-107707","title":"CVE-2026-107707 — Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization ","summary":"Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junction to C:\\Config.msi and abuse Windows Installer rollback to execute code as SYSTEM.","source":"NVD","date":"2026-10-08T20:17:35.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107707","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107707"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107707"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107707"}],"epss":null},{"id":"CVE-2026-107706","title":"CVE-2026-107706 — Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/upda","summary":"Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.","source":"NVD","date":"2026-10-08T20:17:35.503Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107706","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107706"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107706"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107706"}],"epss":null},{"id":"CVE-2026-107705","title":"CVE-2026-107705 — Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that al","summary":"Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack memory when opening AESV3/R6 encrypted PDFs. Attackers can supply a password longer than 127 bytes through applications using the libpoppler, libpoppler-glib or C++ API to overflow the K1 and E buffers, crashing the process or corrupting memory.","source":"NVD","date":"2026-10-08T20:17:35.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107705","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107705"],"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107705"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107705"}],"epss":null},{"id":"CVE-2026-107608","title":"CVE-2026-107608 — Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib befo","summary":"Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.\n\n\n\nTo remediate this issue, users should upgrade to version 2.267.0 or later.","source":"NVD","date":"2026-10-08T20:17:34.967Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107608","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107608"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},"read":false,"kev":false,"recordIds":["CVE-2026-107608"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107608"}],"epss":null},{"id":"CVE-2026-107393","title":"CVE-2026-107393 — FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is","summary":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connecting-IP header during failed login attempts and stores the spoofed value in the activity log. LogsMonitor inserts the value into an administrator alert email without HTML escaping, allowing injected HTML to execute when an administrator opens the email. This issue is fixed in version 1.8.235.","source":"NVD","date":"2026-10-08T20:17:33.893Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107393","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107393"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107393"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107393"}],"epss":null},{"id":"CVE-2026-107392","title":"CVE-2026-107392 — music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser han","summary":"music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated impact is availability loss only and requires the DSF parsing path. This issue is fixed in version 11.15.0.","source":"NVD","date":"2026-10-08T20:17:33.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107392","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107392"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107392"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107392"}],"epss":null},{"id":"CVE-2026-107391","title":"CVE-2026-107391 — music-metadata is a metadata parser for audio and video media files. In the public development revision i","summary":"music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor from advancing while an attacker-controlled entry_count keeps the synchronous loop running. A crafted MP4-family input can block the Node.js event loop and grow the sample-description table until the process is terminated or exhausts memory. The vulnerable change was present on the public master branch but was not included in music-metadata 11.14.0 or any earlier npm release, and version 11.16.0 contains the fix. This issue is fixed in version 11.16.0.","source":"NVD","date":"2026-10-08T20:17:33.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107391","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107391","GHSA-F94X-6692-553Q"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107391","GHSA-f94x-6692-553q"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107391"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-f94x-6692-553q"}],"epss":{"score":0.00129,"date":"2026-10-12","percentile":0.0223}},{"id":"CVE-2026-107390","title":"CVE-2026-107390 — music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser acc","summary":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom fits within its parent or the available input. A tiny MP4-family file can route an oversized length into payload parsing for atoms including mvhd, stsd, stsz, and date, causing a large allocation attempt or process failure before end-of-input validation. Applications that parse untrusted MP4-family media can therefore be denied service. This issue is fixed in version 11.16.0.","source":"NVD","date":"2026-10-08T20:17:33.357Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107390","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107390"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107390"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107390"}],"epss":null},{"id":"CVE-2026-107389","title":"CVE-2026-107389 — music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and W","summary":"music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker-controlled VINT element length and uses it for string-token or Uint8Array allocation before confirming that the leaf fits within its parent or available input. Crafted WebM, MKV, or MKA inputs can cause disproportionate allocations, out-of-memory denial of service, or, for a demonstrated parseFile path on Node.js 26.7.0, an uncatchable V8 fatal abort. The exact failure mode depends on the tokenizer, parser API, and runtime, but the affected leaf-length validation flaw is shared and has availability impact only. This issue is fixed in version 11.16.0.","source":"NVD","date":"2026-10-08T20:17:33.190Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107389","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107389","GHSA-5GFJ-9Q3V-QFP3"],"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107389","GHSA-5gfj-9q3v-qfp3"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107389"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5gfj-9q3v-qfp3"}],"epss":{"score":0.00117,"date":"2026-10-12","percentile":0.01556}},{"id":"CVE-2026-106436","title":"CVE-2026-106436 — The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds lib","summary":"The BSON encoder in the MongoDB PHP Driver does not check some return values after a document exceeds libbson's size limit. This can leave the encoder in an invalid state. An unauthenticated actor who can cause an affected application to encode an unusually large data structure can terminate the PHP worker or cause the resulting document to omit fields. No MongoDB server connection or database authentication is required.","source":"NVD","date":"2026-10-08T20:17:31.087Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106436","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106436"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106436"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106436"}],"epss":null},{"id":"CVE-2026-106432","title":"CVE-2026-106432 — The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation.","summary":"The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit value without validation. When an affected application encodes a string near 4 GiB, the allocation size can wrap while the copy operation uses the original length. The resulting heap buffer overflow can corrupt process memory or terminate the PHP process. Reaching this issue requires a non-default runtime configuration that permits multi-gigabyte values. No MongoDB server interaction is required.","source":"NVD","date":"2026-10-08T20:17:30.647Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106432","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106432"],"cvss":{"score":2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106432"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106432"}],"epss":null},{"id":"CVE-2026-106126","title":"CVE-2026-106126 — A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (S","summary":"A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.","source":"NVD","date":"2026-10-08T20:17:29.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106126","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106126"],"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"vulnreport@tenable.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106126"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106126"}],"epss":null},{"id":"CVE-2026-104076","title":"CVE-2026-104076 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentic","summary":"TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud service information, or issue POST requests to endpoints such as /Setting3/API/API/v1/LocalNetwork/DNS to alter DNS settings and enable man-in-the-middle attacks on outbound connections to TVU cloud infrastructure.","source":"NVD","date":"2026-10-08T20:17:29.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104076","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104076"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104076"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104076"}],"epss":null},{"id":"CVE-2026-104075","title":"CVE-2026-104075 — TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication b","summary":"TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript validation, to receive a valid session cookie regardless of the password value and gain full administrative control of the device's web management interface.","source":"NVD","date":"2026-10-08T20:17:29.377Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104075","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104075"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104075"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104075"}],"epss":null},{"id":"https://cyberscoop.com/?p=91038","title":"DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub","source":"CyberScoop","date":"2026-10-08T20:02:11.000Z","summary":"The seizures of the tools, allegedly operated by the Chinese firm Integrity Tech, accompanied a warning from the FBI, CISA and NSA.  The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop .","url":"https://cyberscoop.com/doj-fbi-seize-flax-typhoon-hacking-tools-microscan-fishhub/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91038"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/doj-fbi-seize-flax-typhoon-hacking-tools-microscan-fishhub/"}],"epss":null},{"id":"https://cyberscoop.com/?p=91031","title":"Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions","source":"CyberScoop","date":"2026-10-08T19:44:29.000Z","summary":"Zohar Pinhasi allegedly deceived ransomware recovery clients into a payment scheme disguised as a specialized service that helped victims avoid paying cybercriminals.  The post Ransomware recovery CEO indicted after allegedly paying hackers and pocketing millions appeared first on CyberScoop .","url":"https://cyberscoop.com/monstercloud-zohar-pinhasi-ransomware-recovery-scheme/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91031"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/monstercloud-zohar-pinhasi-ransomware-recovery-scheme/"}],"epss":null},{"id":"CVE-2026-107387","title":"music-metadata: Uncontrolled memory allocation in APEv2 parser","source":"GitHub Advisories","date":"2026-10-08T19:43:22Z","summary":"0 is vulnerable to uncontrolled memory allocation in the APEv2 parser.  The parser reads the size of an APEv2 tag item from the input file and uses that value to allocate memory before checking whether the file actually contains that many bytes.","url":"https://github.com/advisories/GHSA-53v6-4h7p-p4gj","topic":"Code & supply chain","read":false,"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107387","GHSA-53V6-4H7P-P4GJ"],"kev":false,"recordIds":["GHSA-53v6-4h7p-p4gj","CVE-2026-107387"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-53v6-4h7p-p4gj"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107387"}],"epss":{"score":0.00191,"date":"2026-10-12","percentile":0.08022}},{"id":"CVE-2026-107388","title":"music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS","source":"GitHub Advisories","date":"2026-10-08T19:43:17Z","summary":"### Summary The ID3v2 parser in music-metadata trusts the tag size field without validation and allocates the full requested buffer before reading.  A specially crafted MP3 file with a truncated ID3v2 tag can force allocation of up to 268 MB from a 10-byte file, causing server memory exhaustion.","url":"https://github.com/advisories/GHSA-jjpr-9cvf-cq55","topic":"Code & supply chain","read":false,"cvss":{"score":6.2,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107388","GHSA-JJPR-9CVF-CQ55"],"kev":false,"recordIds":["GHSA-jjpr-9cvf-cq55","CVE-2026-107388"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-jjpr-9cvf-cq55"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107388"}],"epss":{"score":0.00129,"date":"2026-10-12","percentile":0.02229}},{"id":"CVE-2026-107286","title":"Pydantic AI: Concurrency-limited models can keep their slot when a streamed request ends early","source":"GitHub Advisories","date":"2026-10-08T19:42:55Z","summary":"1-sol on behalf of David.  ### Summary Applications that wrap a model with `ConcurrencyLimitedModel` or `limit_model_concurrency` can permanently lose shared concurrency capacity when a streamed request releases its slot from a different task than the one that acquired it.","url":"https://github.com/advisories/GHSA-6fqq-452j-qhrp","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107286","GHSA-6FQQ-452J-QHRP"],"kev":false,"recordIds":["GHSA-6fqq-452j-qhrp","CVE-2026-107286"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6fqq-452j-qhrp"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107286"}],"epss":{"score":0.0045,"date":"2026-10-12","percentile":0.37227}},{"id":"CVE-2026-107385","title":"MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES","source":"GitHub Advisories","date":"2026-10-08T19:42:28Z","summary":"### Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NO_BACKSLASH_ESCAPES SQL mode.  The server status flag was declared (STATUS_NO_BACKSLASH_ESCAPES) but never read.","url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","topic":"Code & supply chain","read":false,"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107385","GHSA-R3RV-JM3R-62Q2"],"kev":false,"recordIds":["GHSA-r3rv-jm3r-62q2","CVE-2026-107385"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107385"}],"epss":{"score":0.00438,"date":"2026-10-12","percentile":0.3622}},{"id":"CVE-2026-107384","title":"MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)","source":"GitHub Advisories","date":"2026-10-08T19:42:23Z","summary":"### Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name.  The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.","url":"https://github.com/advisories/GHSA-v6pj-gxxw-phfw","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107384","GHSA-V6PJ-GXXW-PHFW"],"kev":false,"recordIds":["GHSA-v6pj-gxxw-phfw","CVE-2026-107384"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-v6pj-gxxw-phfw"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107384"}],"epss":{"score":0.00447,"date":"2026-10-12","percentile":0.37041}},{"id":"CVE-2026-107383","title":"MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters","source":"GitHub Advisories","date":"2026-10-08T19:42:11Z","summary":"### Description When encoding a GeoJSON Polygon or MultiPolygon parameter for the binary protocol, the connector sized its output buffer from the length property of each ring, then wrote each ring only if it was a real array.  The two loops disagreed: any non-array ring carrying a numeric length (a string, or an object such as {\"length\": 4000}) still reserved 4 + 16 * length bytes, but wrote none of them.","url":"https://github.com/advisories/GHSA-48qf-xh34-q73r","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107383","GHSA-48QF-XH34-Q73R"],"kev":false,"recordIds":["GHSA-48qf-xh34-q73r","CVE-2026-107383"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-48qf-xh34-q73r"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107383"}],"epss":{"score":0.00388,"date":"2026-10-12","percentile":0.30949}},{"id":"CVE-2026-107382","title":"MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS","source":"GitHub Advisories","date":"2026-10-08T19:42:04Z","summary":"validateFingerPrint`).  That validation calls `hash()` on the authentication plugin in use to obtain the password-derived secret both sides combine with the seed and the certificate fingerprint.","url":"https://github.com/advisories/GHSA-cx2f-j9fh-8g68","topic":"Code & supply chain","read":false,"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107382","GHSA-CX2F-J9FH-8G68"],"kev":false,"recordIds":["GHSA-cx2f-j9fh-8g68","CVE-2026-107382"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cx2f-j9fh-8g68"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107382"}],"epss":{"score":0.00235,"date":"2026-10-12","percentile":0.13351}},{"id":"CVE-2026-107378","title":"CairoSVG: Quadratic-time DoS parsing a crafted SVG","source":"GitHub Advisories","date":"2026-10-08T19:41:22Z","summary":"## Summary Rendering an untrusted SVG whose ` ` contains many segments is O(n²) CPU.  A single ` ` under 1 MiB burns tens of seconds.","url":"https://github.com/advisories/GHSA-c3jg-qh8m-j3h2","topic":"Code & supply chain","read":false,"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107378","GHSA-C3JG-QH8M-J3H2"],"kev":false,"recordIds":["GHSA-c3jg-qh8m-j3h2","CVE-2026-107378"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c3jg-qh8m-j3h2"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107378"}],"epss":{"score":0.00383,"date":"2026-10-12","percentile":0.30364}},{"id":"CVE-2026-95209","title":"CVE-2026-95209 — An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Servi","summary":"An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, leading to a Denial of Service (DoS).","source":"NVD","date":"2026-10-08T19:20:52.830Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95209","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95209"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-95209"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95209"}],"epss":null},{"id":"CVE-2026-88648","title":"CVE-2026-88648 — Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate ","summary":"Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PKI restrictions and issue unauthorized certificates.","source":"NVD","date":"2026-10-08T19:20:52.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88648"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-88648"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88648"}],"epss":null},{"id":"CVE-2026-84290","title":"CVE-2026-84290 — IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied poin","summary":"IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validation of user-supplied pointers in the WfpMonitor kernel driver. Certain METHOD_NEITHER IOCTL handlers dereference user-controlled pointers without adequate probing and exception handling, potentially allowing a privileged local attacker to cause a system crash or perform limited kernel-memory reads.","source":"NVD","date":"2026-10-08T19:20:51.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84290","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-84290"],"cvss":{"score":5.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84290"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84290"}],"epss":null},{"id":"CVE-2026-84278","title":"CVE-2026-84278 — IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_c","summary":"IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.","source":"NVD","date":"2026-10-08T19:20:51.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84278","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84278"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84278"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84278"}],"epss":null},{"id":"CVE-2026-84276","title":"CVE-2026-84276 — IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controll","summary":"IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.","source":"NVD","date":"2026-10-08T19:20:51.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84276","topic":"New vulnerabilities","affected":[{"vendor":"ibm","product":"guardium_data_protection"}],"aliases":["CVE-2026-84276"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-84276"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84276"}],"epss":null},{"id":"CVE-2026-67693","title":"CVE-2026-67693 — An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-","summary":"An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage (KU) and Extended Key Usage (EKU)","source":"NVD","date":"2026-10-08T19:18:41.280Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-67693"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-67693"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67693"}],"epss":null},{"id":"CVE-2026-40804","title":"CVE-2026-40804 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kod","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.","source":"NVD","date":"2026-10-08T19:17:05.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40804","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-40804"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-40804"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40804"}],"epss":null},{"id":"CVE-2026-107704","title":"CVE-2026-107704 — The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageO","summary":"The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.","source":"NVD","date":"2026-10-08T19:17:02.897Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107704","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107704"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107704"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107704"}],"epss":null},{"id":"CVE-2026-107703","title":"CVE-2026-107703 — @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allo","summary":"@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.","source":"NVD","date":"2026-10-08T19:17:02.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107703","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107703"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107703"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107703"}],"epss":null},{"id":"CVE-2026-107701","title":"CVE-2026-107701 — dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Obj","summary":"dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.","source":"NVD","date":"2026-10-08T19:17:02.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107701","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107701"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107701"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107701"}],"epss":null},{"id":"CVE-2026-107700","title":"CVE-2026-107700 — dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to ex","summary":"dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.","source":"NVD","date":"2026-10-08T19:17:02.213Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107700","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107700"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107700"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107700"}],"epss":null},{"id":"CVE-2026-107699","title":"CVE-2026-107699 — ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute ope","summary":"ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.","source":"NVD","date":"2026-10-08T19:17:01.853Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107699","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107699"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107699"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107699"}],"epss":null},{"id":"CVE-2026-107386","title":"CVE-2026-107386 — amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior ","summary":"amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.","source":"NVD","date":"2026-10-08T19:17:01.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107386","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107386"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107386"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107386"}],"epss":null},{"id":"CVE-2026-107325","title":"CVE-2026-107325 — Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and ","summary":"Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an affected application may terminate an unprotected application process, causing a denial of service. No confidentiality or integrity impact has been identified.","source":"NVD","date":"2026-10-08T19:17:00.173Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107325","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107325"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107325"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107325"}],"epss":null},{"id":"CVE-2026-107324","title":"CVE-2026-107324 — An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when","summary":"An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process, causing a denial of service. The driver's server-monitoring path contains panic recovery and is limited to server-selection failure.","source":"NVD","date":"2026-10-08T19:17:00.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107324","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107324"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107324"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107324"}],"epss":null},{"id":"CVE-2026-107322","title":"CVE-2026-107322 — An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.","summary":"An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context.\n\n\n\nTo remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later and verify that the updated plugin is active in each environment where it is used.","source":"NVD","date":"2026-10-08T19:16:59.857Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107322","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107322"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},"read":false,"kev":false,"recordIds":["CVE-2026-107322"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107322"}],"epss":null},{"id":"CVE-2026-106438","title":"CVE-2026-106438 — An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-pre","summary":"An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decimal string to an embedding application, including through Extended JSON parsing, can cause the application to store or use an incorrect numeric value.","source":"NVD","date":"2026-10-08T19:16:59.703Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106438","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106438"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106438"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106438"}],"epss":null},{"id":"CVE-2026-106437","title":"CVE-2026-106437 — The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BS","summary":"The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who can influence the length supplied by an embedding application can cause the application to terminate or read or corrupt adjacent process memory. Reaching this issue requires the application to pass an undersized value to bson_reserve_buffer and then perform an affected operation.","source":"NVD","date":"2026-10-08T19:16:59.550Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106437","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106437"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106437"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106437"}],"epss":null},{"id":"CVE-2026-106434","title":"CVE-2026-106434 — The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload u","summary":"The explicit decryption component of MongoDB libmongocrypt can return an unrecognized encrypted payload unchanged instead of returning a decryption error. An actor who can modify stored encrypted fields, such as a database writer, server, or network intermediary, can cause an affected application to process the supplied bytes as decrypted plaintext.","source":"NVD","date":"2026-10-08T19:16:59.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106434","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106434"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106434"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106434"}],"epss":null},{"id":"CVE-2026-106433","title":"CVE-2026-106433 — Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an i","summary":"Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible type when cleaning up a key document containing duplicate masterKey fields. An authenticated actor who can modify key vault documents, or a server that returns such a key document, can cause invalid memory access and invalid frees in the client process. This can terminate the application or corrupt process memory.","source":"NVD","date":"2026-10-08T19:16:59.233Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106433","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106433"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106433"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106433"}],"epss":null},{"id":"CVE-2026-106431","title":"CVE-2026-106431 — An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte imme","summary":"An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embedding application can corrupt adjacent process memory or terminate the process. Reaching this issue requires the application to use the BSON bulk-writer API and produce a precise cumulative document size.","source":"NVD","date":"2026-10-08T19:16:59.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106431","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106431"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106431"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106431"}],"epss":null},{"id":"CVE-2026-106430","title":"CVE-2026-106430 — The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names ","summary":"The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who can influence a name passed by an affected application can cause the application to read distinct values from an unintended field or rename an unintended collection. These operations use the application's existing database credentials.","source":"NVD","date":"2026-10-08T19:16:58.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106430","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106430"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106430"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106430"}],"epss":null},{"id":"CVE-2026-106429","title":"CVE-2026-106429 — An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation f","summary":"An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an application accepts a KMS endpoint containing a colon after its path or query during key creation. The issue does not access memory outside its allocated bounds.","source":"NVD","date":"2026-10-08T19:16:58.750Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106429","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106429"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106429"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106429"}],"epss":null},{"id":"CVE-2026-106428","title":"CVE-2026-106428 — An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte ","summary":"An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-signature verification can cause the application using the driver to terminate. The extra byte is not returned through the protocol.","source":"NVD","date":"2026-10-08T19:16:58.587Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106428","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106428"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cna@mongodb.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106428"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106428"}],"epss":null},{"id":"CVE-2026-105570","title":"CVE-2026-105570 — Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask m","summary":"Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant hostname to reach the genuine provider endpoint while bypassing response masking. If a user completed the OAuth flow, the provider's access and refresh tokens could be returned unmasked to the sandbox, exposing host-managed credentials.","source":"NVD","date":"2026-10-08T19:16:57.133Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105570","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105570"],"cvss":{"score":6.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@docker.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105570"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105570"}],"epss":null},{"id":"CVE-2026-105452","title":"CVE-2026-105452 — Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host e","summary":"Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox could supply an unrecognized credential in another supported authentication header. For affected upstream services, this could authenticate the request to an attacker-controlled account and expose data included in the request.","source":"NVD","date":"2026-10-08T19:16:56.717Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105452","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105452"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@docker.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105452"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105452"}],"epss":null},{"id":"CVE-2026-101998","title":"CVE-2026-101998 — Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-","summary":"Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recover host-managed OAuth access and refresh tokens or a derived Anthropic API key intended to remain outside the sandbox.","source":"NVD","date":"2026-10-08T19:16:56.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101998","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-101998"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@docker.com"},"read":false,"kev":false,"recordIds":["CVE-2026-101998"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101998"}],"epss":null},{"id":"https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html","title":"FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails","source":"The Hacker News","date":"2026-10-08T18:32:21.000Z","summary":"Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8.  S.","url":"https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/fbi-says-china-linked-hackers-ran.html"}],"epss":null},{"id":"CVE-2026-97147","title":"CVE-2026-97147 — In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a q","summary":"In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another project's resource, then write to it. An authenticated project member can use this to rewrite and un-publish another project's public action definitions and environments. A project administrator can create a workbook whose embedded ad-hoc action or workflow name collides with a resource of another project, which moves that resource into the caller's project and causes the original owner's subsequent updates of it to fail with server errors. Only deployments exposing the Mistral API are affected.","source":"NVD","date":"2026-10-08T18:18:33.583Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97147","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97147"],"cvss":{"score":7.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-97147"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97147"}],"epss":null},{"id":"CVE-2026-95210","title":"CVE-2026-95210 — Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containin","summary":"Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.","source":"NVD","date":"2026-10-08T18:18:33.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95210"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-95210"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95210"}],"epss":null},{"id":"CVE-2026-95184","title":"CVE-2026-95184 — Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificate","summary":"Improper certificate validation in gnutls v3.8.13 causes the application to reject legitimate certificates for valid users, leading to a Denial of Service (DoS).","source":"NVD","date":"2026-10-08T18:18:33.240Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95184","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95184"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-95184"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95184"}],"epss":null},{"id":"CVE-2026-93861","title":"CVE-2026-93861 — In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share","summary":"In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further membership naming a third project. The new membership row is created with its project_id defaulted to the accepting project rather than the original workflow owner, and thus the owner can neither see nor delete it. The third project can accept this membership (that it had not actually been granted by the owner), and then read and execute the owner's private workflow; only the accepting (not the owning) project can later revoke that access.","source":"NVD","date":"2026-10-08T18:18:31.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93861","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93861"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-93861"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93861"}],"epss":null},{"id":"CVE-2026-93860","title":"CVE-2026-93860 — In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and ca","summary":"In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.","source":"NVD","date":"2026-10-08T18:18:30.993Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93860","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93860"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-93860"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93860"}],"epss":null},{"id":"CVE-2026-93858","title":"CVE-2026-93858 — In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command va","summary":"In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an arbitrary local command as proxy_command; paramiko starts that command as a subprocess on the executor host under the executor's own service account, independent of whether the SSH connection itself ever succeeds. Only Mistral deployments that permit the std.ssh_proxied action, the default configuration, are affected.","source":"NVD","date":"2026-10-08T18:18:30.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93858","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93858"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-93858"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93858"}],"epss":null},{"id":"CVE-2026-62171","title":"CVE-2026-62171 — Rejected reason: This CVE is a duplicate of another CVE.","summary":"Rejected reason: This CVE is a duplicate of another CVE.","source":"NVD","date":"2026-10-08T18:17:48.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62171","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62171"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62171"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62171"}],"epss":null},{"id":"CVE-2026-62170","title":"CVE-2026-62170 — Rejected reason: This CVE is a duplicate of another CVE.","summary":"Rejected reason: This CVE is a duplicate of another CVE.","source":"NVD","date":"2026-10-08T18:17:48.093Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62170","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62170"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62170"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62170"}],"epss":null},{"id":"CVE-2026-107702","title":"CVE-2026-107702 — QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController:","summary":"QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.","source":"NVD","date":"2026-10-08T18:17:26.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107702","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107702"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107702"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107702"}],"epss":null},{"id":"CVE-2026-107698","title":"CVE-2026-107698 — FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rts","summary":"FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to internal hosts and ports under other schemes, bypassing -protocol_whitelist, to probe internal network services.","source":"NVD","date":"2026-10-08T18:17:26.460Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107698"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107698"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107698"}],"epss":null},{"id":"CVE-2026-107697","title":"CVE-2026-107697 — FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to b","summary":"FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use disallowed protocols or non-multimedia local files, making parse_playlist() open resources the HLS security policy should block.","source":"NVD","date":"2026-10-08T18:17:26.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107697"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107697"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107697"}],"epss":null},{"id":"CVE-2026-107696","title":"CVE-2026-107696 — FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c t","summary":"FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or another server, causing endless reconnects that saturate a CPU core.","source":"NVD","date":"2026-10-08T18:17:26.133Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107696"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107696"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107696"}],"epss":null},{"id":"CVE-2026-107695","title":"CVE-2026-107695 — FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attacke","summary":"FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a crafted self-referencing playlist that endlessly adds variants in hls_read_header(), causing unbounded CPU and I/O consumption.","source":"NVD","date":"2026-10-08T18:17:25.967Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107695"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107695"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107695"}],"epss":null},{"id":"CVE-2026-107380","title":"CVE-2026-107380 — savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an","summary":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such as Tab can appear to the sanitizer as a safe fragment prefix while HTML5 Named Character Reference resolution during inline HTML rendering later converts the surviving reference to whitespace, exposing a javascript: URL. When an application embeds the sanitized SVG inline, a user who activates the link can cause script to execute in the embedding page's origin. This issue is fixed in version 1.0.0.","source":"NVD","date":"2026-10-08T18:17:23.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107380","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107380"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107380"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107380"}],"epss":null},{"id":"CVE-2026-107379","title":"CVE-2026-107379 — savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a ","summary":"savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Sanitizer.php. The first removal deletes the explicit attribute, while the DTD default rematerializes the value before the href safety path performs the second removal, which can corrupt libxml state and terminate the PHP worker. An attacker who can submit SVG content to a sanitization endpoint can repeatedly interrupt workers and degrade or exhaust application availability. This issue is fixed in version 1.0.0.","source":"NVD","date":"2026-10-08T18:17:23.603Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107379","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107379"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107379"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107379"}],"epss":null},{"id":"CVE-2026-107377","title":"CVE-2026-107377 — datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, ","summary":"datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_imports in src/datamodel_code_generator/parser/protobuf.py. Exploitation requires a victim or automated job to process the attacker-controlled schema with Protobuf input support, which requires the grpcio-tools package. The paths escape the weak_imports temporary directory before protoc runs, allowing creation of directory trees and new files or overwrite of existing writable files with a generated Protobuf syntax declaration. The effect persists when later Protobuf compilation fails. The written content is limited to a proto2 or proto3 syntax declaration, and direct arbitrary code exe","source":"NVD","date":"2026-10-08T18:17:22.973Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107377","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107377","GHSA-77XJ-X4RM-935C"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107377","GHSA-77xj-x4rm-935c"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107377"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-77xj-x4rm-935c"}],"epss":{"score":0.00454,"date":"2026-10-12","percentile":0.3759}},{"id":"CVE-2026-107376","title":"CVE-2026-107376 — webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\\Langu","summary":"webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\\Language\\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list types that exhaust the PHP process stack during pre-validation parsing, before query validation and complexity controls run. The resulting SIGSEGV can terminate PHP-FPM workers or long-running Swoole, RoadRunner, ReactPHP, or CLI processes and cannot be caught by application-level exception handling. This issue is fixed in version 15.32.3.","source":"NVD","date":"2026-10-08T18:17:22.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107376","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107376"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107376"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107376"}],"epss":null},{"id":"CVE-2026-107375","title":"CVE-2026-107375 — JHipster is a development platform to quickly generate, develop, and deploy modern web applications and m","summary":"JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends","source":"NVD","date":"2026-10-08T18:17:21.883Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107375","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107375","GHSA-R223-96JV-Q533"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107375","GHSA-r223-96jv-q533"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107375"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r223-96jv-q533"}],"epss":{"score":0.00341,"date":"2026-10-12","percentile":0.25626}},{"id":"CVE-2026-107362","title":"CVE-2026-107362 — Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely ","summary":"Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch API route that instructs the server to download an arbitrary URL with curl (including FOLLOWLOCATION) and, for HEAD requests, stores the fetched response body in the upload container's transfer directory and returns the transfer ID to the caller, enabling full readback of the fetched content.","source":"NVD","date":"2026-10-08T18:17:21.587Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107362","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107362"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107362"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107362"}],"epss":null},{"id":"CVE-2026-107361","title":"CVE-2026-107361 — The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005","summary":"The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-creates users with full access. The passwordSecret is hardcoded to the public value \"Malcolm\". A network-adjacent attacker bypasses nginx entirely by connecting directly to port 8005 with a forged identity header.","source":"NVD","date":"2026-10-08T18:17:21.170Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107361","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107361"],"cvss":{"score":4.2,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107361"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107361"}],"epss":null},{"id":"CVE-2026-107337","title":"CVE-2026-107337 — The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authenticatio","summary":"The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.","source":"NVD","date":"2026-10-08T18:17:20.687Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107337","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107337"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107337"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107337"}],"epss":null},{"id":"CVE-2026-107336","title":"CVE-2026-107336 — Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insens","summary":"Malcolm's front nginx reverse proxy defines a \"Dashboards → Arkime shortcut\" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (the matcher fires) but evades the rewrite (no redirect is issued), so nginx falls through to the location's proxy_pass to the Arkime backend. That location is the one proxied location in the shipped config that does not include the per-location authentication file, so the request reaches Arkime unauthenticated. The same location also forwards a client-supplied X-Forwarded-User header un-overwritten, and Arkime is configured to trust X-Forwarded-User as the authenticated username — so an unauthenticated network caller can reach the Arkime backend while supplying a forged, auto-provision","source":"NVD","date":"2026-10-08T18:17:20.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107336","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107336"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107336"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107336"}],"epss":null},{"id":"CVE-2026-107335","title":"CVE-2026-107335 — Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and t","summary":"Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file is a single-stream compressed format (.gz, .bz2, .xz, .lzma, .lz) that isn't a .tar.*-style archive. Any authenticated user permitted to upload PCAP/log files can upload a small, highly compressible file (e.g. a gzip bomb) that decompresses to an effectively unbounded size on disk, exhausting the shared Docker volume used by OpenSearch, Logstash, Arkime, and Zeek, and disrupting the platform for all users.","source":"NVD","date":"2026-10-08T18:17:19.970Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107335","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107335"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107335"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107335"}],"epss":null},{"id":"CVE-2026-107334","title":"CVE-2026-107334 — Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reac","summary":"Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects which location block actually serves the request using the percent-decoded, normalized URI. Because the RBAC check never percent-decodes its input, an authenticated low-privilege user can request an admin-only path using percent-encoding (e.g. /%68tadmin.php) and have nginx route it to the restricted location while the Lua RBAC gate evaluating the un-decoded raw string finds no matching restriction and grants access.","source":"NVD","date":"2026-10-08T18:17:19.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107334","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107334"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107334"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107334"}],"epss":null},{"id":"CVE-2026-107333","title":"CVE-2026-107333 — Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based","summary":"Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all restricted paths protected by the RBAC authorization layer, including file upload, PHP server, htadmin, and authentication management interfaces.","source":"NVD","date":"2026-10-08T18:17:19.603Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107333","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107333"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"ics-cert@hq.dhs.gov"},"read":false,"kev":false,"recordIds":["CVE-2026-107333"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107333"}],"epss":null},{"id":"CVE-2026-107332","title":"CVE-2026-107332 — Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0","summary":"Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files.\n\n\n\nTo mitigate this issue, users should upgrade to version 4.10.0 or later.","source":"NVD","date":"2026-10-08T18:17:19.443Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107332","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107332"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},"read":false,"kev":false,"recordIds":["CVE-2026-107332"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107332"}],"epss":null},{"id":"CVE-2026-107303","title":"CVE-2026-107303 — JHipster is a development platform to quickly generate, develop, and deploy modern web applications and m","summary":"JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster 9.4.0 and react-jhipster 1.1.0, generated applications can persist attacker-controlled Blob data and companion ContentType values, return them through generated REST endpoints, and pass them to the generated openFile helper in generators/client/generators/common/templates/src/main/webapp/app/shared/jhipster/data-utils.ts.ejs. The helper uses the returned ContentType as the browser Blob MIME type and opens an object URL, so a normal authenticated user with write access to a Blob-bearing entity can store active HTML or SVG content that may execute under the application origin when a privileged user opens it. Exploitability depends on the generated application's content security polic","source":"NVD","date":"2026-10-08T18:17:19.277Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107303","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107303","GHSA-9FFP-22J7-56R2"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107303","GHSA-9ffp-22j7-56r2"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107303"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9ffp-22j7-56r2"}],"epss":{"score":0.00261,"date":"2026-10-12","percentile":0.16494}},{"id":"CVE-2026-107302","title":"CVE-2026-107302 — msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads th","summary":"msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value before validating that the complete five-byte header is available. A truncated map32 header therefore causes a checked out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError, which can unexpectedly terminate a request, stream, or worker in applications that wait for additional bytes after IncompleteBufferError. There is no adjacent-memory disclosure because the buffer implementation checks bounds. This issue is fixed in version 6.1.0.","source":"NVD","date":"2026-10-08T18:17:19.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107302","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107302","GHSA-8F34-F56X-9XPH"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107302","GHSA-8f34-f56x-9xph"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107302"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8f34-f56x-9xph"}],"epss":{"score":0.00426,"date":"2026-10-12","percentile":0.35018}},{"id":"CVE-2026-61431","title":"PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace","source":"GitHub Advisories","date":"2026-10-08T17:58:30Z","summary":"` traversal paths.  When context gathering runs, PraisonAI opens those outside paths and appends their contents to the generated context bundle.","url":"https://github.com/advisories/GHSA-q7m5-3jmv-vm48","topic":"Code & supply chain","read":false,"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61431","GHSA-Q7M5-3JMV-VM48"],"kev":false,"recordIds":["GHSA-q7m5-3jmv-vm48"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-q7m5-3jmv-vm48"}],"epss":{"score":0.00352,"date":"2026-10-12","percentile":0.2696}},{"id":"https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html","title":"ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories","source":"The Hacker News","date":"2026-10-08T17:58:02.000Z","summary":"The crooks have trust problems of their own.  One ransomware affiliate decided to keep the profits for himself.","url":"https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/threatsday-ransomware-affiliate.html"}],"epss":null},{"id":"CVE-2026-60088","title":"PraisonAI: Project custom command templates can read outside-workspace files into model prompts","source":"GitHub Advisories","date":"2026-10-08T17:57:49Z","summary":"md`.  When a user runs `praisonai run --command ` inside a repository, the command body is interpolated before it is sent as the model prompt.","url":"https://github.com/advisories/GHSA-xpx6-x8c2-mw5w","topic":"Code & supply chain","read":false,"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-60088","GHSA-XPX6-X8C2-MW5W"],"kev":false,"recordIds":["GHSA-xpx6-x8c2-mw5w"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-xpx6-x8c2-mw5w"}],"epss":{"score":0.00182,"date":"2026-10-12","percentile":0.07143}},{"id":"CVE-2026-106444","title":"Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates","source":"GitHub Advisories","date":"2026-10-08T17:52:37Z","summary":"precompile()` generates JavaScript source that is commonly embedded in browser ` ` elements.  Before the fix, static template text containing ` ` was emitted unchanged.","url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7","topic":"Code & supply chain","read":false,"cvss":{"score":4.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-106444","GHSA-XW65-4HP5-5HC7"],"kev":false,"recordIds":["GHSA-xw65-4hp5-5hc7","CVE-2026-106444"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-xw65-4hp5-5hc7"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106444"}],"epss":{"score":0.00294,"date":"2026-10-12","percentile":0.20353}},{"id":"CVE-2026-106446","title":"Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)","source":"GitHub Advisories","date":"2026-10-08T17:52:32Z","summary":"precompile()` accept a pre-parsed AST as well as a template string.  9 added validation for such ASTs.","url":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj","topic":"Code & supply chain","read":false,"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-106446","GHSA-8R5X-FM3F-WHWJ"],"kev":false,"recordIds":["GHSA-8r5x-fm3f-whwj","CVE-2026-106446"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8r5x-fm3f-whwj"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106446"}],"epss":{"score":0.0064,"date":"2026-10-12","percentile":0.49225}},{"id":"CVE-2026-106445","title":"Handlebars: JavaScript Injection via Own Property Check Bypass","source":"GitHub Advisories","date":"2026-10-08T17:52:26Z","summary":"## Summary Handlebars can expose the `Function` constructor despite its prototype-access deny list.  prototype`, its own `constructor` property is returned before the deny list is checked.","url":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f","topic":"Code & supply chain","read":false,"cvss":{"score":9.2,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-106445","GHSA-P8WG-VRV2-V86F"],"kev":false,"recordIds":["GHSA-p8wg-vrv2-v86f","CVE-2026-106445"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p8wg-vrv2-v86f"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106445"}],"epss":{"score":0.00411,"date":"2026-10-12","percentile":0.33473}},{"id":"CVE-2026-106119","title":"LangChain: MongoDBChatMessageHistory query injection can allow cross-session access","source":"GitHub Advisories","date":"2026-10-08T17:52:22Z","summary":"## Impact `MongoDBChatMessageHistory` did not enforce the documented string type for session identifiers at runtime.  In affected applications, a structured session identifier could be interpreted as a MongoDB query condition rather than as a literal identifier.","url":"https://github.com/advisories/GHSA-m6rx-h84q-8r95","topic":"Code & supply chain","read":false,"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-106119","GHSA-M6RX-H84Q-8R95"],"kev":false,"recordIds":["GHSA-m6rx-h84q-8r95","CVE-2026-106119"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-m6rx-h84q-8r95"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106119"}],"epss":{"score":0.00463,"date":"2026-10-12","percentile":0.38274}},{"id":"CVE-2026-107211","title":"Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic","source":"GitHub Advisories","date":"2026-10-08T17:52:17Z","summary":"PivotField` that need not match the cache's field count.  go:1443.","url":"https://github.com/advisories/GHSA-mx22-3794-2vpv","topic":"Code & supply chain","read":false,"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107211","GHSA-MX22-3794-2VPV"],"kev":false,"recordIds":["GHSA-mx22-3794-2vpv","CVE-2026-107211"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mx22-3794-2vpv"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107211"}],"epss":{"score":0.00291,"date":"2026-10-12","percentile":0.20032}},{"id":"GHSA-RP9V-7XV3-R6G3","title":"Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor","source":"GitHub Advisories","date":"2026-10-08T17:52:00Z","summary":"Close()` sits inside a `for` loop in the multipart processor.  Go defers run at function return, not loop end, so every file part in the request holds an open fd until `ProcessRequest()` exits.","url":"https://github.com/advisories/GHSA-rp9v-7xv3-r6g3","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["GHSA-RP9V-7XV3-R6G3"],"kev":false,"recordIds":["GHSA-rp9v-7xv3-r6g3"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-rp9v-7xv3-r6g3"}],"epss":null},{"id":"GHSA-W253-M66G-RX24","title":"Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection","source":"GitHub Advisories","date":"2026-10-08T17:51:53Z","summary":"### Summary Coraza fails to inspect URL-encoded form bodies when their valid `Content-Type` contains a media-type parameter, for example: ```http Content-Type: application/x-www-form-urlencoded; charset=UTF-8 ``` An unauthenticated attacker can use this header to hide the complete form body from custom Coraza rules that inspect `ARGS_POST` or `REQUEST_BODY`, while the bundled Go HTTP middleware forwards the body and the backend parses it normally.  This is a deterministic request-body inspection bypass.","url":"https://github.com/advisories/GHSA-w253-m66g-rx24","topic":"Code & supply chain","read":false,"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-W253-M66G-RX24"],"kev":false,"recordIds":["GHSA-w253-m66g-rx24"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w253-m66g-rx24"}],"epss":null},{"id":"GHSA-3C6W-J9XM-8H2H","title":"Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion","source":"GitHub Advisories","date":"2026-10-08T17:51:42Z","summary":"### Summary The JSON response body processor parses response bodies with no recursion limit.  `ProcessResponse` calls `readJSON(ss, ignoreJSONRecursionLimit)`, and that constant is `-1`.","url":"https://github.com/advisories/GHSA-3c6w-j9xm-8h2h","topic":"Code & supply chain","read":false,"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["GHSA-3C6W-J9XM-8H2H"],"kev":false,"recordIds":["GHSA-3c6w-j9xm-8h2h"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3c6w-j9xm-8h2h"}],"epss":null},{"id":"GHSA-3WR7-993Q-JRFF","title":"Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules","source":"GitHub Advisories","date":"2026-10-08T17:51:36Z","summary":"ParseMediaType`, which only decodes the RFC 5987/6266 extended `filename*` `Content-Disposition` parameter when its declared charset is exactly `us-ascii` or `utf-8`.  Any other charset — including `iso-8859-1`, which RFC 5987 explicitly permits — is silently dropped by the stdlib, with no error and no fallback signal.","url":"https://github.com/advisories/GHSA-3wr7-993q-jrff","topic":"Code & supply chain","read":false,"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-3WR7-993Q-JRFF"],"kev":false,"recordIds":["GHSA-3wr7-993q-jrff"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3wr7-993q-jrff"}],"epss":null},{"id":"GHSA-G4QM-M288-5CP9","title":"Coraza has Cookie Parser Confusion","source":"GitHub Advisories","date":"2026-10-08T17:51:30Z","summary":"ParseCookies`) does not strip ASCII control characters (CTLs) from the edges of a cookie name/value before they're matched against `REQUEST_COOKIES` / `REQUEST_COOKIES_NAMES`.  When a CTL sits directly next to the `=` separator, Coraza absorbs it into the adjacent name or value, while several backend cookie parsers trim it away — so the WAF and the application disagree about the cookie it just received.","url":"https://github.com/advisories/GHSA-g4qm-m288-5cp9","topic":"Code & supply chain","read":false,"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-G4QM-M288-5CP9"],"kev":false,"recordIds":["GHSA-g4qm-m288-5cp9"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-g4qm-m288-5cp9"}],"epss":null},{"id":"GHSA-X26Q-WVHG-FH4M","title":"Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations","source":"GitHub Advisories","date":"2026-10-08T17:46:00Z","summary":"go`, lines 834–866.  RawQuery } ...","url":"https://github.com/advisories/GHSA-x26q-wvhg-fh4m","topic":"Code & supply chain","read":false,"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-X26Q-WVHG-FH4M"],"kev":false,"recordIds":["GHSA-x26q-wvhg-fh4m"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x26q-wvhg-fh4m"}],"epss":null},{"id":"CVE-2026-104774","title":"Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass","source":"GitHub Advisories","date":"2026-10-08T17:45:53Z","summary":"### Summary The `t:jsDecode` transformation in Coraza WAF contains an off-by-one error when parsing octal escape sequences.  ParseInt` to fail for every octal escape sequence and return a null byte instead of the decoded value that would normally be returned.","url":"https://github.com/advisories/GHSA-pc5q-qfxp-ggqv","topic":"Code & supply chain","read":false,"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-104774","GHSA-PC5Q-QFXP-GGQV"],"kev":false,"recordIds":["GHSA-pc5q-qfxp-ggqv"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pc5q-qfxp-ggqv"}],"epss":null},{"id":"GHSA-6GCQ-WC29-5XF2","title":"Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)","source":"GitHub Advisories","date":"2026-10-08T17:45:46Z","summary":"go`) can be made to crash the whole process with an unrecoverable `fatal error: stack overflow`, using a request body that is well under the recommended `SecRequestBodyLimit` and the default `SecArgumentsLimit`.  Parse(s) ...","url":"https://github.com/advisories/GHSA-6gcq-wc29-5xf2","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["GHSA-6GCQ-WC29-5XF2"],"kev":false,"recordIds":["GHSA-6gcq-wc29-5xf2"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-6gcq-wc29-5xf2"}],"epss":null},{"id":"GHSA-5GJ4-9GM7-2FX2","title":"Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection","source":"GitHub Advisories","date":"2026-10-08T17:45:31Z","summary":"### Summary Coraza's JSON body processor converts nested JSON properties into dot-separated `ARGS_POST` names without escaping dots contained in literal property names.  role`; the later value `safe` replaces the SQL-injection value.","url":"https://github.com/advisories/GHSA-5gj4-9gm7-2fx2","topic":"Code & supply chain","read":false,"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["GHSA-5GJ4-9GM7-2FX2"],"kev":false,"recordIds":["GHSA-5gj4-9gm7-2fx2"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5gj4-9gm7-2fx2"}],"epss":null},{"id":"https://cyberscoop.com/?p=91023","title":"OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media","source":"CyberScoop","date":"2026-10-08T17:44:43.000Z","summary":"The two campaigns were rated 4 and 5 out of 6 for severity, the first time OpenAI has reported what it considers a high-impact influence campaigns.  The post OpenAI says Iran, Russia used AI journalists, think tanks to influence Western media appeared first on CyberScoop .","url":"https://cyberscoop.com/openai-disrupts-russia-iran-ai-influence-operations/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=91023"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/openai-disrupts-russia-iran-ai-influence-operations/"}],"epss":null},{"id":"CVE-2026-107287","title":"Pydantic AI: Excessive resource use when local web fetching converts nested HTML","source":"GitHub Advisories","date":"2026-10-08T17:40:50Z","summary":"### Summary Applications using Pydantic AI's local web-fetch tool can experience excessive CPU and memory use when it converts attacker-controlled HTML.  An agent must fetch the affected page; provider-native web fetching is not affected.","url":"https://github.com/advisories/GHSA-v36g-jcw9-x7cw","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107287","GHSA-V36G-JCW9-X7CW"],"kev":false,"recordIds":["GHSA-v36g-jcw9-x7cw","CVE-2026-107287"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-v36g-jcw9-x7cw"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107287"}],"epss":{"score":0.00277,"date":"2026-10-12","percentile":0.18569}},{"id":"CVE-2026-107300","title":"msgpack5: Many buffered values can exhaust the streaming decoder stack","source":"GitHub Advisories","date":"2026-10-08T17:40:06Z","summary":"### Impact The streaming decoder recursively invokes itself for every complete value remaining in a chunk.  A single chunk containing many small valid MessagePack values can exhaust the JavaScript call stack and interrupt the process or stream.","url":"https://github.com/advisories/GHSA-5x5g-h9x8-2fh9","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107300","GHSA-5X5G-H9X8-2FH9"],"kev":false,"recordIds":["GHSA-5x5g-h9x8-2fh9","CVE-2026-107300"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-5x5g-h9x8-2fh9"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107300"}],"epss":{"score":0.00426,"date":"2026-10-12","percentile":0.35018}},{"id":"CVE-2026-107299","title":"msgpack5: Reserved byte can cause unbounded stream buffering","source":"GitHub Advisories","date":"2026-10-08T17:40:01Z","summary":"### Impact The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input.  When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.","url":"https://github.com/advisories/GHSA-26wq-p25c-j6fv","topic":"Code & supply chain","read":false,"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107299","GHSA-26WQ-P25C-J6FV"],"kev":false,"recordIds":["GHSA-26wq-p25c-j6fv","CVE-2026-107299"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-26wq-p25c-j6fv"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107299"}],"epss":{"score":0.00389,"date":"2026-10-12","percentile":0.31002}},{"id":"CVE-2026-107301","title":"msgpack5: Partial options disable prototype protection","source":"GitHub Advisories","date":"2026-10-08T17:39:57Z","summary":"### Impact Passing an empty or partial options object disables the default `protoAction: 'error'` protection.  A map containing a `__proto__` key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.","url":"https://github.com/advisories/GHSA-8hq7-ggx2-cc6m","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-107301","GHSA-8HQ7-GGX2-CC6M"],"kev":false,"recordIds":["GHSA-8hq7-ggx2-cc6m","CVE-2026-107301"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8hq7-ggx2-cc6m"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107301"}],"epss":{"score":0.00366,"date":"2026-10-12","percentile":0.28535}},{"id":"CVE-2026-107298","title":"msgpack5: Deeply nested input can exhaust the decoder stack","source":"GitHub Advisories","date":"2026-10-08T17:39:51Z","summary":"### Impact The decoder has no nesting-depth limit for arrays and maps.  An attacker who can provide MessagePack input can use deeply nested containers to exhaust the JavaScript call stack and interrupt the process or request handler.","url":"https://github.com/advisories/GHSA-24ch-f2g6-9hhh","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-107298","GHSA-24CH-F2G6-9HHH"],"kev":false,"recordIds":["GHSA-24ch-f2g6-9hhh","CVE-2026-107298"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-24ch-f2g6-9hhh"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107298"}],"epss":{"score":0.00372,"date":"2026-10-12","percentile":0.29156}},{"id":"CVE-2026-107297","title":"msgpack5: Quadratic parsing in the streaming decoder","source":"GitHub Advisories","date":"2026-10-08T17:39:46Z","summary":"### Impact The streaming decoder reparses an incomplete container from the beginning whenever another chunk arrives.  A remote peer can split one valid MessagePack value across many small chunks, causing quadratic CPU usage and blocking the event loop.","url":"https://github.com/advisories/GHSA-gcx5-hxj7-gpqq","topic":"Code & supply chain","read":false,"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107297","GHSA-GCX5-HXJ7-GPQQ"],"kev":false,"recordIds":["GHSA-gcx5-hxj7-gpqq","CVE-2026-107297"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-gcx5-hxj7-gpqq"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107297"}],"epss":{"score":0.00389,"date":"2026-10-12","percentile":0.31002}},{"id":"CVE-2026-107296","title":"msgpack5: Decoding negative int64 values mutates the input buffer","source":"GitHub Advisories","date":"2026-10-08T17:39:30Z","summary":"### Impact Decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer.  Applications that retain or reuse encoded input for integrity checks, logging, or subsequent processing may observe silently corrupted data.","url":"https://github.com/advisories/GHSA-qw35-55vc-rhgj","topic":"Code & supply chain","read":false,"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107296","GHSA-QW35-55VC-RHGJ"],"kev":false,"recordIds":["GHSA-qw35-55vc-rhgj","CVE-2026-107296"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-qw35-55vc-rhgj"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107296"}],"epss":{"score":0.00276,"date":"2026-10-12","percentile":0.18436}},{"id":"CVE-2026-88647","title":"CVE-2026-88647 — A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback ","summary":"A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name fallback mechanism and eavesdrop on communications via a crafted certificate.","source":"NVD","date":"2026-10-08T17:17:17.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88647"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-88647"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88647"}],"epss":null},{"id":"CVE-2026-62167","title":"CVE-2026-62167 — Rejected reason: This CVE is a duplicate of another CVE.","summary":"Rejected reason: This CVE is a duplicate of another CVE.","source":"NVD","date":"2026-10-08T17:17:17.720Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62167","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62167"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62167"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62167"}],"epss":null},{"id":"CVE-2026-62166","title":"CVE-2026-62166 — Rejected reason: This CVE is a duplicate of another CVE.","summary":"Rejected reason: This CVE is a duplicate of another CVE.","source":"NVD","date":"2026-10-08T17:17:17.663Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62166","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62166"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62166"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62166"}],"epss":null},{"id":"CVE-2026-62163","title":"CVE-2026-62163 — Rejected reason: Reason: This candidate is a duplicate of CVE-2026-60089.","summary":"Rejected reason: Reason: This candidate is a duplicate of CVE-2026-60089.","source":"NVD","date":"2026-10-08T17:17:17.587Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62163","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62163"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-62163"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62163"}],"epss":null},{"id":"CVE-2026-61801","title":"CVE-2026-61801 — The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-s","summary":"The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files. Versions before 0.4.1 do not sufficiently limit entries when parsing `/etc/passwd`- or `/etc/group`-style files, allowing an attacker who can supply a specially crafted file to cause excessive memory consumption and potentially terminate the affected process due to an out-of-memory condition. This issue is patched in version 0.4.1. As a workaround, avoid parsing attacker-controlled user or group database files, or validate and limit untrusted input before parsing it.","source":"NVD","date":"2026-10-08T17:17:17.433Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-61801","GHSA-MJCV-P78Q-W5FW"],"cvss":{"score":5.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-61801","GHSA-mjcv-p78q-w5fw"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61801"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mjcv-p78q-w5fw"}],"epss":{"score":0.00113,"date":"2026-10-12","percentile":0.01328}},{"id":"CVE-2026-50055","title":"CVE-2026-50055 — A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled m","summary":"A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve notify action to send copies of email content and headers to an arbitrary address.","source":"NVD","date":"2026-10-08T17:17:17.307Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50055","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-50055"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"cve@rapid7.com"},"read":false,"kev":false,"recordIds":["CVE-2026-50055"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50055"}],"epss":null},{"id":"CVE-2026-50054","title":"CVE-2026-50054 — An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access t","summary":"An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant another local account the loginAs right, creating persistent mailbox access and mail-sending authority that survives password changes and session expiry.","source":"NVD","date":"2026-10-08T17:17:17.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50054","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-50054"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","source":"cve@rapid7.com"},"read":false,"kev":false,"recordIds":["CVE-2026-50054"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50054"}],"epss":null},{"id":"CVE-2026-10631","title":"CVE-2026-10631 — An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 ","summary":"An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a share or delegation grant.","source":"NVD","date":"2026-10-08T17:17:16.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10631","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-10631"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"cve@rapid7.com"},"read":false,"kev":false,"recordIds":["CVE-2026-10631"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10631"}],"epss":null},{"id":"CVE-2026-107709","title":"CVE-2026-107709 — A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability lo","summary":"A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause files to be written outside the intended extraction directory. Successful exploitation may allow arbitrary file overwrite, application compromise, or remote code execution depending on the target environment and writable sibling paths.","source":"NVD","date":"2026-10-08T17:17:16.293Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107709","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107709"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-107709"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107709"}],"epss":null},{"id":"CVE-2026-107295","title":"CVE-2026-107295 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0.","source":"NVD","date":"2026-10-08T17:17:15.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107295","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107295","GHSA-H4XC-3QFQ-JF93"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107295","GHSA-h4xc-3qfq-jf93"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107295"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-h4xc-3qfq-jf93"}],"epss":{"score":0.0016,"date":"2026-10-12","percentile":0.04679}},{"id":"CVE-2026-107294","title":"CVE-2026-107294 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.2 and 2.24.0, web_fetch_tool, the WebFetch local fallback, and remote FileUrl media downloads buffer the complete HTTP response body before enforcing content-size controls. An attacker-influenced URL can stream an arbitrarily large response that exhausts process memory and crashes the worker; affected media types include ImageUrl, DocumentUrl, VideoUrl, and AudioUrl. SSRF protections remain effective, and the impact is limited to availability. This issue is fixed in versions 1.107.2 and 2.24.0.","source":"NVD","date":"2026-10-08T17:17:15.080Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107294","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107294","GHSA-V2XH-2VP8-57H8"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107294","GHSA-v2xh-2vp8-57h8"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107294"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-v2xh-2vp8-57h8"}],"epss":{"score":0.00434,"date":"2026-10-12","percentile":0.35825}},{"id":"CVE-2026-107293","title":"CVE-2026-107293 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.","source":"NVD","date":"2026-10-08T17:17:14.933Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107293","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107293","GHSA-3GH4-CGHQ-F8V4"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107293","GHSA-3gh4-cghq-f8v4"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107293"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3gh4-cghq-f8v4"}],"epss":{"score":0.00336,"date":"2026-10-12","percentile":0.25095}},{"id":"CVE-2026-107292","title":"CVE-2026-107292 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_web() and clai web development chat server does not validate the Host header, allowing a website visited by a developer to use DNS rebinding to reach a loopback-hosted agent as a same-origin service. The hostile page can read the served UI and submit chat requests that execute agent tools with the local process's privileges and credentials, causing data disclosure or unwanted side effects. Binding to localhost, Origin checks, and CSRF tokens do not prevent the same-origin DNS rebinding path. This issue is fixed in versions 1.107.5 and 2.30.0.","source":"NVD","date":"2026-10-08T17:17:14.770Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107292","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107292","GHSA-Q2XC-RRXJ-58X9"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107292","GHSA-q2xc-rrxj-58x9"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107292"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-q2xc-rrxj-58x9"}],"epss":{"score":0.00132,"date":"2026-10-12","percentile":0.0241}},{"id":"CVE-2026-107291","title":"CVE-2026-107291 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions","source":"NVD","date":"2026-10-08T17:17:14.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107291","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107291","GHSA-4X9P-G9WM-8Q7F"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107291","GHSA-4x9p-g9wm-8q7f"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107291"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4x9p-g9wm-8q7f"}],"epss":{"score":0.00392,"date":"2026-10-12","percentile":0.31395}},{"id":"CVE-2026-107290","title":"CVE-2026-107290 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback process server-controlled responses with quadratic title extraction, whitespace normalization, and ordered-list numbering. An attacker-controlled page of modest size can therefore block the event loop for an extended period, stalling other agent runs and requests, while unsupported codecs or excessive HTML or JSON nesting can abort an individual run. This issue is fixed in versions 1.107.6 and 2.44.0.","source":"NVD","date":"2026-10-08T17:17:14.413Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107290","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107290","GHSA-FPF4-VWCP-V4HP"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107290","GHSA-fpf4-vwcp-v4hp"],"sources":["NVD","GitHub Advisories"],"topics":["New vulnerabilities","Code & supply chain"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107290"},{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fpf4-vwcp-v4hp"}],"epss":{"score":0.0042,"date":"2026-10-12","percentile":0.34386}},{"id":"CVE-2026-105436","title":"CVE-2026-105436 — Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injecti","summary":"Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.","source":"NVD","date":"2026-10-08T17:17:12.363Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105436","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105436"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105436"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105436"}],"epss":null},{"id":"CVE-2026-104078","title":"CVE-2026-104078 — Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe c","summary":"Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \\href value with a TAB byte in the URL scheme, causing filterURL to produce an empty protocol that bypasses the configured safeProtocols restrictions. Attackers can craft a note containing a malicious MathJax formula that renders as a javascript: URL anchor, which when clicked by the victim in Live Preview executes in the Node-integration-enabled vault renderer via require('child_process'), achieving arbitrary operating system command execution as the desktop user.","source":"NVD","date":"2026-10-08T17:17:11.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104078","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104078"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104078"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104078"}],"epss":null},{"id":"CVE-2026-104077","title":"CVE-2026-104077 — Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to cr","summary":"Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, allowing a javascript: URL to execute in the resulting background iframe. Because Node integration is enabled and context isolation is disabled in Obsidian's vault renderer, the injected script can call parent.require() to access Node APIs such as fs and child_process, enabling arbitrary operating system command execution when the victim opens the note and manually starts the presentation.","source":"NVD","date":"2026-10-08T17:17:11.603Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104077","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104077"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104077"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104077"}],"epss":null},{"id":"CVE-2026-60090","title":"PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL","source":"GitHub Advisories","date":"2026-10-08T17:17:01Z","summary":"# PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL ## Summary The PGVector and Cassandra knowledge-store backends validate SQL/CQL identifiers such as schema, keyspace, and collection names, but still insert the caller-controlled `dimension` argument directly into `CREATE TABLE` vector column declarations.  A caller that can influence collection creation dimensions can append SQL/CQL tokens to the generated DDL executed by the database driver.","url":"https://github.com/advisories/GHSA-wf65-4jjx-q444","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-60090","GHSA-WF65-4JJX-Q444"],"kev":false,"recordIds":["GHSA-wf65-4jjx-q444"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-wf65-4jjx-q444"}],"epss":{"score":0.00702,"date":"2026-10-12","percentile":0.51936}},{"id":"CVE-2026-107212","title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days","source":"GitHub Advisories","date":"2026-10-08T16:50:13Z","summary":"GetRows` and the `Rows` iterator loop once for every missing row.  Columns`, which also reads ` ` elements.","url":"https://github.com/advisories/GHSA-jw42-f3rr-4cc3","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107212","GHSA-JW42-F3RR-4CC3"],"kev":false,"recordIds":["GHSA-jw42-f3rr-4cc3","CVE-2026-107212"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-jw42-f3rr-4cc3"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107212"}],"epss":{"score":0.00339,"date":"2026-10-12","percentile":0.25396}},{"id":"CVE-2026-107213","title":"Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element","source":"GitHub Advisories","date":"2026-10-08T16:50:08Z","summary":"Drawing itself.  xml, populated separately by encoding/xml depending on whether each tag is present.","url":"https://github.com/advisories/GHSA-r7x5-4969-99p7","topic":"Code & supply chain","read":false,"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107213","GHSA-R7X5-4969-99P7"],"kev":false,"recordIds":["GHSA-r7x5-4969-99p7","CVE-2026-107213"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r7x5-4969-99p7"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107213"}],"epss":{"score":0.00291,"date":"2026-10-12","percentile":0.20033}},{"id":"CVE-2026-107228","title":"AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)","source":"GitHub Advisories","date":"2026-10-08T16:50:03Z","summary":"### Impact With the cookie store enabled, which is the default, a `Cookie` header that the caller sets on a request with `setHeader` or `addHeader` is thrown away whenever the store holds any cookie for the request's origin: the request's cookie list is written into that header afterwards and replaces it.  CVE-2024-53990 fixed the same problem for cookies added with `addCookie`, but that fix works on the cookie list, and a header set directly never reaches it.","url":"https://github.com/advisories/GHSA-2jwh-9rmr-j4xf","topic":"Code & supply chain","read":false,"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107228","GHSA-2JWH-9RMR-J4XF"],"kev":false,"recordIds":["GHSA-2jwh-9rmr-j4xf","CVE-2026-107228"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2jwh-9rmr-j4xf"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107228"}],"epss":{"score":0.00301,"date":"2026-10-12","percentile":0.21028}},{"id":"CVE-2026-107226","title":"AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS","source":"GitHub Advisories","date":"2026-10-08T16:49:59Z","summary":"### Impact The cookie store ignores the scheme a `Set-Cookie` arrived on.  7 requires a user agent to ignore a cookie with the `Secure` attribute unless it arrived over a secure connection (step 13), and to ignore a non-Secure cookie from an insecure connection when it would overlay a Secure cookie the store already holds (step 16).","url":"https://github.com/advisories/GHSA-p2jm-6hj6-9rjg","topic":"Code & supply chain","read":false,"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107226","GHSA-P2JM-6HJ6-9RJG"],"kev":false,"recordIds":["GHSA-p2jm-6hj6-9rjg"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p2jm-6hj6-9rjg"}],"epss":null},{"id":"CVE-2026-107227","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","source":"GitHub Advisories","date":"2026-10-08T16:49:53Z","summary":"### Impact With WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size.  INSTANCE`, whose inflater is unbounded, and `webSocketMaxFrameSize` and `webSocketMaxBufferSize` only bound the compressed bytes, because the frame aggregator sits in front of the inflater.","url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107227","GHSA-X8V2-478Q-2HVG"],"kev":false,"recordIds":["GHSA-x8v2-478q-2hvg","CVE-2026-107227"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107227"}],"epss":{"score":0.00432,"date":"2026-10-12","percentile":0.35542}},{"id":"CVE-2026-107230","title":"AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins","source":"GitHub Advisories","date":"2026-10-08T16:49:46Z","summary":"1 connection pool key, so that a connection one principal authenticated with NTLM, Kerberos or SPNEGO is not handed to another.  It left three cases out.","url":"https://github.com/advisories/GHSA-v2j5-22fr-j62r","topic":"Code & supply chain","read":false,"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107230","GHSA-V2J5-22FR-J62R"],"kev":false,"recordIds":["GHSA-v2j5-22fr-j62r","CVE-2026-107230"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-v2j5-22fr-j62r"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107230"}],"epss":{"score":0.00188,"date":"2026-10-12","percentile":0.07743}},{"id":"CVE-2026-61443","title":"PraisonAI: SkillTools Executes Scripts Without Path Containment Validation","source":"GitHub Advisories","date":"2026-10-08T16:49:23Z","summary":"run()` without any path containment validation.  While `FileTools` has `_validate_path()` with traversal detection, `SkillTools` performs none.","url":"https://github.com/advisories/GHSA-c44f-37qr-gw3f","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61443","GHSA-C44F-37QR-GW3F"],"kev":false,"recordIds":["GHSA-c44f-37qr-gw3f"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-c44f-37qr-gw3f"}],"epss":{"score":0.00769,"date":"2026-10-12","percentile":0.5435}},{"id":"CVE-2026-61437","title":"PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlow","source":"GitHub Advisories","date":"2026-10-08T16:48:57Z","summary":"py` to execute arbitrary Python code when the workflow is executed.  ### Details The vulnerability is located in the workflow structured output resolution logic.","url":"https://github.com/advisories/GHSA-4gfv-wg42-7jw5","topic":"Code & supply chain","read":false,"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-61437","GHSA-4GFV-WG42-7JW5"],"kev":false,"recordIds":["GHSA-4gfv-wg42-7jw5"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4gfv-wg42-7jw5"}],"epss":{"score":0.00174,"date":"2026-10-12","percentile":0.0627}},{"id":"CVE-2026-61432","title":"PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace","source":"GitHub Advisories","date":"2026-10-08T16:48:52Z","summary":"` traversal paths without checking that the resolved path remains under that workspace.  A lower-trust prompt or caller that can influence FastContext tool arguments can read, search, and enumerate files outside the intended project workspace; the resulting file content is then returned to the caller or injected into the model's tool-result context.","url":"https://github.com/advisories/GHSA-4xxv-6wmf-xf45","topic":"Code & supply chain","read":false,"cvss":{"score":5.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61432","GHSA-4XXV-6WMF-XF45"],"kev":false,"recordIds":["GHSA-4xxv-6wmf-xf45"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4xxv-6wmf-xf45"}],"epss":{"score":0.00407,"date":"2026-10-12","percentile":0.33008}},{"id":"CVE-2026-107289","title":"Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers","source":"GitHub Advisories","date":"2026-10-08T16:48:06Z","summary":"### Summary When an application using Pydantic AI opts a URL into local network access — either a `FileUrl` with `force_download='allow-local'`, or `web_fetch_tool(allow_local_urls=True)` — the cloud-metadata blocklist could be bypassed by appending an IPv6 zone identifier to a metadata address (for example `fd00:ec2::254%251`).  The host ignores the zone identifier on a destination that is not link-local and delivers the request to the metadata endpoint anyway, exposing cloud IAM short-term credentials.","url":"https://github.com/advisories/GHSA-vmxc-h2x2-jmf3","topic":"Code & supply chain","read":false,"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107289","GHSA-VMXC-H2X2-JMF3"],"kev":false,"recordIds":["GHSA-vmxc-h2x2-jmf3","CVE-2026-107289"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-vmxc-h2x2-jmf3"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107289"}],"epss":{"score":0.00328,"date":"2026-10-12","percentile":0.2401}},{"id":"CVE-2026-61446","title":"PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification","source":"GitHub Advisories","date":"2026-10-08T16:44:04Z","summary":"spec_from_file_location()` + `exec_module()` with zero code signing, integrity verification, or sandboxing.  Any attacker who can write a file to the plugins directory (via path traversal, supply chain attack, or compromised dependency) achieves arbitrary code execution when the plugin system initializes.","url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g","topic":"Code & supply chain","read":false,"cvss":{"score":8.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-61446","GHSA-M6WP-H223-4C8G"],"kev":false,"recordIds":["GHSA-m6wp-h223-4c8g"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-m6wp-h223-4c8g"}],"epss":{"score":0.00325,"date":"2026-10-12","percentile":0.23677}},{"id":"CVE-2026-61447","title":"PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets","source":"GitHub Advisories","date":"2026-10-08T16:44:01Z","summary":"copy()`), zero AST validation, zero import restrictions, and no sandbox enforcement — even when `CodeConfig(sandbox=True)` is explicitly set.  This allows an attacker who can influence LLM output (via prompt injection in agent input, tool results, or ingested content) to exfiltrate all environment secrets (API keys, database credentials, cloud tokens) and execute arbitrary code on the host.","url":"https://github.com/advisories/GHSA-2xv2-w8cq-5gxw","topic":"Code & supply chain","read":false,"cvss":{"score":10,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-61447","GHSA-2XV2-W8CQ-5GXW"],"kev":false,"recordIds":["GHSA-2xv2-w8cq-5gxw"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2xv2-w8cq-5gxw"}],"epss":{"score":0.0249,"date":"2026-10-12","percentile":0.84208}},{"id":"CVE-2026-60087","title":"PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments","source":"GitHub Advisories","date":"2026-10-08T16:43:45Z","summary":"## Summary PraisonAI gates dangerous tools (file writes, deletes, shell/code execution) behind an interactive approval prompt.  The first approval of a tool is cached for the remainder of the run and silently reused for all later invocations of that tool with arbitrary, unreviewed arguments.","url":"https://github.com/advisories/GHSA-29r9-67vg-qj56","topic":"Code & supply chain","read":false,"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-60087","GHSA-29R9-67VG-QJ56"],"kev":false,"recordIds":["GHSA-29r9-67vg-qj56"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-29r9-67vg-qj56"}],"epss":{"score":0.00148,"date":"2026-10-12","percentile":0.03544}},{"id":"CVE-2026-61430","title":"PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure","source":"GitHub Advisories","date":"2026-10-08T16:36:50Z","summary":"## Summary PraisonAI's `web_crawl` agent tool performs a server-side HTTP fetch of an agent/attacker-influenced URL.  SSRF is meant to be prevented by `_is_safe_crawl_url()`, which resolves the hostname and rejects private/loopback/link-local IPs **at validation time**.","url":"https://github.com/advisories/GHSA-qg25-6gc4-48mg","topic":"Code & supply chain","read":false,"cvss":{"score":8.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61430","GHSA-QG25-6GC4-48MG"],"kev":false,"recordIds":["GHSA-qg25-6gc4-48mg"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-qg25-6gc4-48mg"}],"epss":{"score":0.00348,"date":"2026-10-12","percentile":0.26415}},{"id":"CVE-2026-60089","title":"PraisonAI: Project config can auto-save agent output outside the project root","source":"GitHub Advisories","date":"2026-10-08T16:36:34Z","summary":"toml` defaults when constructing an `Agent`.  ` traversal path.","url":"https://github.com/advisories/GHSA-qjw5-xwrp-xwpq","topic":"Code & supply chain","read":false,"cvss":null,"aliases":["CVE-2026-60089","GHSA-QJW5-XWRP-XWPQ"],"kev":false,"recordIds":["GHSA-qjw5-xwrp-xwpq"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-qjw5-xwrp-xwpq"}],"epss":{"score":0.00142,"date":"2026-10-12","percentile":0.03008}},{"id":"CVE-2026-107214","title":"Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks","source":"GitHub Advisories","date":"2026-10-08T16:31:32Z","summary":"### Summary Any file whose first 8 bytes are the OLE compound-file signature (`D0 CF 11 E0 A1 B1 1A E1`) is routed by `OpenFile`/`OpenReader`/`OpenBytes` → `openReaderAt` → `Decrypt`.  The version dispatch only guarantees `len(EncryptionInfo) >= 4` before handing attacker-controlled `EncryptionInfo`/`EncryptedPackage` buffers to `standardDecrypt`/`agileDecrypt`, and no callee validates structure.","url":"https://github.com/advisories/GHSA-2j4c-ffch-9f23","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107214","GHSA-2J4C-FFCH-9F23"],"kev":false,"recordIds":["GHSA-2j4c-ffch-9f23","CVE-2026-107214"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-2j4c-ffch-9f23"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107214"}],"epss":{"score":0.00271,"date":"2026-10-12","percentile":0.17854}},{"id":"CVE-2026-107215","title":"Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS","source":"GitHub Advisories","date":"2026-10-08T16:31:26Z","summary":"go:109-120`: full uint64 → int64 for major version 4, low uint32 for v3).  e.","url":"https://github.com/advisories/GHSA-x2q3-8cjh-766f","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107215","GHSA-X2Q3-8CJH-766F"],"kev":false,"recordIds":["GHSA-x2q3-8cjh-766f","CVE-2026-107215"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x2q3-8cjh-766f"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107215"}],"epss":{"score":0.00223,"date":"2026-10-12","percentile":0.1193}},{"id":"CVE-2026-107216","title":"Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow","source":"GitHub Advisories","date":"2026-10-08T16:31:21Z","summary":"go:896-900).  The circular-reference control only exists **within one context**: the entry-exclusion marker and per-ref iteration budget are fields of that single context, and completion-based caching (`formulaArgCache`/`calcRawCache`) only ever stores results of evaluations that *finish*.","url":"https://github.com/advisories/GHSA-wp2g-vpjj-g53r","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-107216","GHSA-WP2G-VPJJ-G53R"],"kev":false,"recordIds":["GHSA-wp2g-vpjj-g53r","CVE-2026-107216"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-wp2g-vpjj-g53r"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107216"}],"epss":{"score":0.00311,"date":"2026-10-12","percentile":0.22103}},{"id":"CVE-2026-107283","title":"AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source","source":"GitHub Advisories","date":"2026-10-08T16:31:04Z","summary":"### Impact The client nonce used in HTTP Digest authentication was generated from ThreadLocalRandom, a fast but non-cryptographic pseudorandom number generator.  3 requires the cnonce to be unpredictable, since it is part of what protects the Digest exchange against chosen-plaintext and precomputation attacks on the credentials.","url":"https://github.com/advisories/GHSA-mfj3-87qq-382v","topic":"Code & supply chain","read":false,"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107283","GHSA-MFJ3-87QQ-382V"],"kev":false,"recordIds":["GHSA-mfj3-87qq-382v","CVE-2026-107283"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mfj3-87qq-382v"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107283"}],"epss":{"score":0.00263,"date":"2026-10-12","percentile":0.16681}},{"id":"CVE-2026-107285","title":"AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel","source":"GitHub Advisories","date":"2026-10-08T16:30:58Z","summary":"### Impact When a ws:// request is routed through an HTTP proxy with proxy authentication configured, the client tunnels the connection with an HTTP CONNECT, the same as it does for https://.  Once the tunnel is open, the WebSocket upgrade request that follows is sent through the tunnel directly to the origin server, not to the proxy.","url":"https://github.com/advisories/GHSA-3wp9-xfwm-rjjf","topic":"Code & supply chain","read":false,"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-107285","GHSA-3WP9-XFWM-RJJF"],"kev":false,"recordIds":["GHSA-3wp9-xfwm-rjjf","CVE-2026-107285"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3wp9-xfwm-rjjf"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107285"}],"epss":{"score":0.00206,"date":"2026-10-12","percentile":0.09745}},{"id":"CVE-2026-107280","title":"AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk","source":"GitHub Advisories","date":"2026-10-08T16:30:53Z","summary":"3, which asks whether the request host is the domain or ends with a dot followed by it.  3 step 5, which additionally requires rejecting a `Domain` that is a public suffix, is not implemented anywhere in the client.","url":"https://github.com/advisories/GHSA-f9m8-cv68-674w","topic":"Code & supply chain","read":false,"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107280","GHSA-F9M8-CV68-674W"],"kev":false,"recordIds":["GHSA-f9m8-cv68-674w","CVE-2026-107280"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-f9m8-cv68-674w"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107280"}],"epss":{"score":0.0026,"date":"2026-10-12","percentile":0.16386}},{"id":"CVE-2026-107282","title":"AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host","source":"GitHub Advisories","date":"2026-10-08T16:30:46Z","summary":"### Impact When a request is replayed onto a different host, the client updates only the current request and leaves the target request pointing at the original host.  Four consumers read that stale value, and each one sends the first host's request, credentials, or both to the second host.","url":"https://github.com/advisories/GHSA-jmqq-x5g9-9p2w","topic":"Code & supply chain","read":false,"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107282","GHSA-JMQQ-X5G9-9P2W"],"kev":false,"recordIds":["GHSA-jmqq-x5g9-9p2w","CVE-2026-107282"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-jmqq-x5g9-9p2w"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107282"}],"epss":{"score":0.00189,"date":"2026-10-12","percentile":0.07806}},{"id":"CVE-2026-107231","title":"AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext","source":"GitHub Advisories","date":"2026-10-08T16:23:36Z","summary":"### Impact A Digest challenge that does not yield a usable nonce is treated as a Basic challenge.  The client then answers it with `Authorization: Basic`, which carries the username and password base64 encoded and so recoverable by anyone who sees the request.","url":"https://github.com/advisories/GHSA-rqf5-2wxv-rjf4","topic":"Code & supply chain","read":false,"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-107231","GHSA-RQF5-2WXV-RJF4"],"kev":false,"recordIds":["GHSA-rqf5-2wxv-rjf4","CVE-2026-107231"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-rqf5-2wxv-rjf4"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107231"}],"epss":{"score":0.00237,"date":"2026-10-12","percentile":0.1354}},{"id":"CVE-2026-95208","title":"CVE-2026-95208 — An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allo","summary":"An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to cause a Denial of Service (DoS) via providing crafted Certificate Authority certificates, leading to valid certificates without SAN to be incorrectly rejected by wolfSSL-based TLS clients.","source":"NVD","date":"2026-10-08T16:18:01.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95208","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95208"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-95208"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95208"}],"epss":null},{"id":"CVE-2026-19585","title":"CVE-2026-19585 — HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path ","summary":"HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.","source":"NVD","date":"2026-10-08T16:17:10.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19585","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19585"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","source":"security@hashicorp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-19585"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19585"}],"epss":null},{"id":"CVE-2026-107678","title":"CVE-2026-107678 — FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libav","summary":"FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionInitInfo linked lists built by the MOV demuxer's mov_read_pssh(). Attackers can supply a crafted MP4 file with tens of thousands of small pssh boxes to exhaust the stack and crash the process, while also causing quadratic CPU consumption.","source":"NVD","date":"2026-10-08T16:17:05.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107678"],"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107678"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107678"}],"epss":null},{"id":"CVE-2026-107677","title":"CVE-2026-107677 — FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers","summary":"FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemplate media URL. Attackers can craft an .mpd manifest declaring SegmentTemplate media=\"\" so get_current_fragment() calls av_strireplace() with an empty search string, consuming CPU indefinitely.","source":"NVD","date":"2026-10-08T16:17:05.430Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107677"],"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107677"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107677"}],"epss":null},{"id":"CVE-2026-107676","title":"CVE-2026-107676 — FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_","summary":"FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when tone_mapping_flag is 0. Attackers can supply crafted Matroska T.35 BlockAdditional or HEVC/AV1 SEI metadata so that remuxing or transcoding writes leaked process memory into output files.","source":"NVD","date":"2026-10-08T16:17:05.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107676"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107676"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107676"}],"epss":null},{"id":"CVE-2026-107675","title":"CVE-2026-107675 — FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp prot","summary":"FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers. Attackers performing man-in-the-middle, DNS, or ARP spoofing can capture passwords supplied in sftp URLs, serve forged media, or receive uploaded output.","source":"NVD","date":"2026-10-08T16:17:05.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107675"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107675"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107675"}],"epss":null},{"id":"CVE-2026-107660","title":"CVE-2026-107660 — FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls","summary":"FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname checks for IP-address hosts. Network attackers can intercept https, rtmps, or tls connections to IP-literal URLs with any trusted CA-issued certificate to read and tamper with streams.","source":"NVD","date":"2026-10-08T16:17:04.893Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107660"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107660"}],"epss":null},{"id":"CVE-2026-107288","title":"CVE-2026-107288 — Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From ","summary":"Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local web_fetch_tool and the WebFetch local fallback compare blocked_domains entries with a URL hostname before both values are normalized to the form used by getaddrinfo. An attacker-influenced model can use an equivalent IDNA spelling, non-ASCII label separator, case variation, or trailing root label that resolves to a blocked host but does not match the configured string, causing the application to fetch that host with its own privileges. allowed_domains fails closed for unmatched spellings, and private-IP and cloud-metadata protections remain effective. This issue is fixed in versions 1.107.6 and 2.44.0.","source":"NVD","date":"2026-10-08T16:17:04.147Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107288","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107288"],"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107288"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107288"}],"epss":null},{"id":"CVE-2026-106177","title":"CVE-2026-106177 — A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privileg","summary":"A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33 may allow local privilege escalation or arbitrary code execution. HP has released version 4.4.33 to address this vulnerability.","source":"NVD","date":"2026-10-08T16:17:01.777Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106177","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106177"],"cvss":{"score":6.4,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"hp-security-alert@hp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106177"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106177"}],"epss":null},{"id":"https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html","title":"Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks","source":"The Hacker News","date":"2026-10-08T15:45:56.000Z","summary":"Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said.  The Tokyo-based center, which takes incident reports, based its&nbsp;October 8, 2026 alert&nbsp;on those reports and other information.","url":"https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/japan-sees-sharp-rise-in-web-data-leaks.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49883","title":"Cisco Patches a Dozen Critical Vulnerabilities","source":"SecurityWeek","date":"2026-10-08T15:28:06.000Z","summary":"The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.  The post Cisco Patches a Dozen Critical Vulnerabilities appeared first on SecurityWeek .","url":"https://www.securityweek.com/cisco-patches-a-dozen-critical-vulnerabilities/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49883"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/cisco-patches-a-dozen-critical-vulnerabilities/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html","title":"UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML","source":"The Hacker News","date":"2026-10-08T15:26:56.000Z","summary":"NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.  According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel.","url":"https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.html"}],"epss":null},{"id":"CVE-2026-9209","title":"CVE-2026-9209 — mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.asp","summary":"mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attackers can submit arbitrary SQL through these exposed endpoints to invoke xp_cmdshell and xp_read_file, achieving pre-authentication remote code execution as LocalSystem via a single HTTP request.","source":"NVD","date":"2026-10-08T15:17:57.677Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9209","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-9209"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-9209"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9209"}],"epss":null},{"id":"CVE-2026-95125","title":"CVE-2026-95125 — libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF","summary":"libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service.","source":"NVD","date":"2026-10-08T15:17:57.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95125","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-95125"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-95125"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95125"}],"epss":null},{"id":"CVE-2026-93034","title":"CVE-2026-93034 — SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditional","summary":"SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or authentication; this vulnerability persists via the msgpack path even when SGLANG_USE_PICKLE_IPC is disabled, and becomes remotely exploitable if data-parallel attention is enabled with a non-loopback --dist-init-addr setting.","source":"NVD","date":"2026-10-08T15:17:57.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93034","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93034"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-93034"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93034"}],"epss":null},{"id":"CVE-2026-93017","title":"CVE-2026-93017 — The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets i","summary":"The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access to every secret in every namespace in the cluster.\n\nRef: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373\n```\n- apiGroups:\n  - \"\"\n  resources:\n  - secrets\n  verbs:\n  - get\n  - list\n```\n\nBy spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace.\n\n```\nspec:\n serviceAccountName:\"gather\"\n```","source":"NVD","date":"2026-10-08T15:17:56.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93017","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93017"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93017"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93017"}],"epss":null},{"id":"CVE-2026-14999","title":"CVE-2026-14999 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass authentication by forging valid JSON Web Signatures due to improper verification of cryptographic signatures.","source":"NVD","date":"2026-10-08T15:17:50.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14999","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14999"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14999"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14999"}],"epss":null},{"id":"CVE-2026-14992","title":"CVE-2026-14992 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.","source":"NVD","date":"2026-10-08T15:17:50.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14992","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14992"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14992"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14992"}],"epss":null},{"id":"CVE-2026-14988","title":"CVE-2026-14988 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.","source":"NVD","date":"2026-10-08T15:17:49.973Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14988","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14988"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14988"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14988"}],"epss":null},{"id":"CVE-2026-14905","title":"CVE-2026-14905 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.","source":"NVD","date":"2026-10-08T15:17:49.837Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14905","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14905"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14905"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14905"}],"epss":null},{"id":"CVE-2026-14888","title":"CVE-2026-14888 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.","source":"NVD","date":"2026-10-08T15:17:49.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14888","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14888"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14888"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14888"}],"epss":null},{"id":"CVE-2026-14509","title":"CVE-2026-14509 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to algorithmic complexity in linked-list traversal.","source":"NVD","date":"2026-10-08T15:17:49.560Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14509","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14509"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14509"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14509"}],"epss":null},{"id":"CVE-2026-14508","title":"CVE-2026-14508 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive information due to a use-after-free.","source":"NVD","date":"2026-10-08T15:17:49.413Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14508","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14508"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14508"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14508"}],"epss":null},{"id":"CVE-2026-14507","title":"CVE-2026-14507 — IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a de","summary":"IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.","source":"NVD","date":"2026-10-08T15:17:49.283Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14507","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14507"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14507"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14507"}],"epss":null},{"id":"CVE-2026-14502","title":"CVE-2026-14502 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication.","source":"NVD","date":"2026-10-08T15:17:49.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14502","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14502"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14502"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14502"}],"epss":null},{"id":"CVE-2026-14497","title":"CVE-2026-14497 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.","source":"NVD","date":"2026-10-08T15:17:49.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14497","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14497"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14497"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14497"}],"epss":null},{"id":"CVE-2026-14496","title":"CVE-2026-14496 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.","source":"NVD","date":"2026-10-08T15:17:48.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14496","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14496"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14496"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14496"}],"epss":null},{"id":"CVE-2026-14273","title":"CVE-2026-14273 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization.","source":"NVD","date":"2026-10-08T15:17:48.733Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14273","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14273"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14273"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14273"}],"epss":null},{"id":"CVE-2026-14269","title":"CVE-2026-14269 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An unauthenticated remote attacker could overflow the buffer and execute arbitrary code on the system.","source":"NVD","date":"2026-10-08T15:17:48.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14269","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14269"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14269"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14269"}],"epss":null},{"id":"CVE-2026-13258","title":"CVE-2026-13258 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-08T15:17:48.393Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13258","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-13258"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-13258"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13258"}],"epss":null},{"id":"CVE-2026-13257","title":"CVE-2026-13257 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity.","source":"NVD","date":"2026-10-08T15:17:48.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13257","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-13257"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-13257"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13257"}],"epss":null},{"id":"CVE-2026-12859","title":"CVE-2026-12859 — Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Ac","summary":"Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","source":"NVD","date":"2026-10-08T15:17:48.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12859","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-12859"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-12859"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12859"}],"epss":null},{"id":"CVE-2026-107640","title":"CVE-2026-107640 — Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/pas","summary":"Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthenticated attackers to change account passwords by omitting the reset parameter. Attackers can target accounts with no pending reset, whose empty reset_key matches the defaulted empty value, to take over administrator accounts after enumerating valid usernames.","source":"NVD","date":"2026-10-08T15:17:47.343Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107640","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107640"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107640"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107640"}],"epss":null},{"id":"CVE-2026-107639","title":"CVE-2026-107639 — ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in","summary":"ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.","source":"NVD","date":"2026-10-08T15:17:47.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107639","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107639"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107639"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107639"}],"epss":null},{"id":"CVE-2026-107638","title":"CVE-2026-107638 — pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attem","summary":"pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attackers to bypass two-factor authentication by guessing TOTP codes without limits. Attackers who know an account password can submit unlimited 6-digit verification codes to VerificationCodeFormProcess.php to take over member, affiliate, or administrator accounts.","source":"NVD","date":"2026-10-08T15:17:46.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107638","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107638"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107638"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107638"}],"epss":null},{"id":"CVE-2026-107637","title":"CVE-2026-107637 — pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the ","summary":"pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's note ID in the POST id parameter to remove all comments and category associations, since those queries lack profile ID checks.","source":"NVD","date":"2026-10-08T15:17:46.737Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107637","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107637"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107637"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107637"}],"epss":null},{"id":"CVE-2026-107636","title":"CVE-2026-107636 — pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows ","summary":"pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set item_number, cart_order_id, or the PayPal custom field while paying a token amount, or submit uncompleted PayPal IPN payments, to gain the most expensive membership and its paid features.","source":"NVD","date":"2026-10-08T15:17:46.543Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107636","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107636"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107636"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107636"}],"epss":null},{"id":"CVE-2026-107635","title":"CVE-2026-107635 — Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allo","summary":"Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes. Attackers can supply a malicious BitLocker volume image with a datum_size smaller than the 36-byte AES-CCM header, causing hexdump() to over-read and crash dislocker.","source":"NVD","date":"2026-10-08T15:17:46.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107635","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107635"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107635"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107635"}],"epss":null},{"id":"CVE-2026-107634","title":"CVE-2026-107634 — Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_da","summary":"Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.","source":"NVD","date":"2026-10-08T15:17:46.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107634","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107634"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107634"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107634"}],"epss":null},{"id":"CVE-2026-107623","title":"CVE-2026-107623 — A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the respon","summary":"A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.","source":"NVD","date":"2026-10-08T15:17:46.017Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107623","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107623"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107623"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107623"}],"epss":null},{"id":"CVE-2026-107604","title":"CVE-2026-107604 — A flaw was found in the installation provider and client registration endpoints of the Keycloak identity ","summary":"A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.","source":"NVD","date":"2026-10-08T15:17:45.290Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107604","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107604"],"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107604"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107604"}],"epss":null},{"id":"CVE-2026-107589","title":"CVE-2026-107589 — Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI u","summary":"Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generate arbitrary account names.","source":"NVD","date":"2026-10-08T15:17:45.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107589","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107589"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107589"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107589"}],"epss":null},{"id":"CVE-2026-107586","title":"CVE-2026-107586 — Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.2","summary":"Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped its least recently used session whenever it was full, whoever it belonged to, and placed no limit on how many sessions one account could hold. A user who repeatedly signs in with their own mailbox password can therefore keep the table full and sign out every webmail and administration session that is idle for more than a short time, for as long as they continue.","source":"NVD","date":"2026-10-08T15:17:44.897Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107586","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107586"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107586"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107586"}],"epss":null},{"id":"CVE-2026-107585","title":"CVE-2026-107585 — Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.","summary":"Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to make other users' OpenID Connect, SAML and passkey sign-ins fail. The routes that start a single sign-on and hand out a passkey sign-in challenge are reached without authentication and stored pending state in bounded tables that dropped their oldest entry when full, whoever had started it. An attacker who starts sign-ins a few times a second (about a hundred a second for passkeys) pushes every other user's pending sign-in out of the table before that user's browser returns, denying single sign-on and passkey sign-in for as long as the requests continue.","source":"NVD","date":"2026-10-08T15:17:44.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107585","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107585"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107585"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107585"}],"epss":null},{"id":"CVE-2026-107565","title":"CVE-2026-107565 — A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption w","summary":"A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.","source":"NVD","date":"2026-10-08T15:17:43.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107565","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107565"],"cvss":{"score":5.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107565"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107565"}],"epss":null},{"id":"CVE-2026-105833","title":"CVE-2026-105833 — EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\\Servi","summary":"EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\\Service that allows users with Email Account scope access to retrieve other users' IMAP passwords. Attackers who know a victim's Email Account record ID can request that record to steal stored IMAP credentials and access the victim's mailbox.","source":"NVD","date":"2026-10-08T15:17:35.913Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105833","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105833"],"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105833"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105833"}],"epss":null},{"id":"CVE-2026-105832","title":"CVE-2026-105832 — EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the","summary":"EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accepts a login stopped at the second factor on routes not requiring authentication. Attackers knowing a 2FA-enabled user's username and password can skip the second factor to read config parameters not exposed publicly.","source":"NVD","date":"2026-10-08T15:17:35.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105832","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105832"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105832"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105832"}],"epss":null},{"id":"CVE-2026-105831","title":"CVE-2026-105831 — EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attacker","summary":"EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.","source":"NVD","date":"2026-10-08T15:17:35.507Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105831","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105831"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105831"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105831"}],"epss":null},{"id":"CVE-2026-105830","title":"CVE-2026-105830 — league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in t","summary":"league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters, forcing repeated full-buffer strpos scans that exhaust PHP worker CPU.","source":"NVD","date":"2026-10-08T15:17:35.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105830","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105830"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105830"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105830"}],"epss":null},{"id":"CVE-2026-105829","title":"CVE-2026-105829 — League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows user","summary":"League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.","source":"NVD","date":"2026-10-08T15:17:35.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105829","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105829"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105829"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105829"}],"epss":null},{"id":"CVE-2026-105828","title":"CVE-2026-105828 — Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vuln","summary":"Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validation error messages reveal hidden class names when public introspection is disabled. Unauthenticated attackers holding only the public Application Id can send crafted operations triggering unknown-argument or invalid enum value errors to learn pointer and relation target classes.","source":"NVD","date":"2026-10-08T15:17:34.993Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105828","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105828"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"disclosure@vulncheck.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105828"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105828"}],"epss":null},{"id":"CVE-2026-105827","title":"CVE-2026-105827 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:34.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105827","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105827"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105827"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105827"}],"epss":null},{"id":"CVE-2026-105826","title":"CVE-2026-105826 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:34.650Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105826"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105826"}],"epss":null},{"id":"CVE-2026-105825","title":"CVE-2026-105825 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:34.490Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105825","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105825"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105825"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105825"}],"epss":null},{"id":"CVE-2026-105824","title":"CVE-2026-105824 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:34.323Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105824","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105824"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105824"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105824"}],"epss":null},{"id":"CVE-2026-105823","title":"CVE-2026-105823 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:34.140Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105823","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105823"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105823"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105823"}],"epss":null},{"id":"CVE-2026-105405","title":"CVE-2026-105405 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.963Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105405","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105405"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105405"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105405"}],"epss":null},{"id":"CVE-2026-105404","title":"CVE-2026-105404 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.800Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105404","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105404"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105404"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105404"}],"epss":null},{"id":"CVE-2026-105403","title":"CVE-2026-105403 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105403","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105403"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105403"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105403"}],"epss":null},{"id":"CVE-2026-105402","title":"CVE-2026-105402 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105402","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105402"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105402"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105402"}],"epss":null},{"id":"CVE-2026-105401","title":"CVE-2026-105401 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105401","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105401"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105401"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105401"}],"epss":null},{"id":"CVE-2026-105400","title":"CVE-2026-105400 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:33.127Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105400","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105400"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105400"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105400"}],"epss":null},{"id":"CVE-2026-105399","title":"CVE-2026-105399 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:32.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105399","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105399"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105399"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105399"}],"epss":null},{"id":"CVE-2026-105398","title":"CVE-2026-105398 — Rejected reason: This CVE ID has been rejected as a duplicate.","summary":"Rejected reason: This CVE ID has been rejected as a duplicate.","source":"NVD","date":"2026-10-08T15:17:32.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105398","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105398"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-105398"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105398"}],"epss":null},{"id":"CVE-2026-105331","title":"CVE-2026-105331 — Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle ","summary":"Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with access to edit the Oracle Instant Client referenced by the agent plugin 'mk-oracle' to escalate their privileges if an agent has this plugin enabled.","source":"NVD","date":"2026-10-08T15:17:32.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105331","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105331"],"cvss":{"score":5.2,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@checkmk.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105331"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105331"}],"epss":null},{"id":"https://www.securityweek.com/?p=49788","title":"Security Awareness Training Isn&#8217;t Dead, but It Needs a Rethink","source":"SecurityWeek","date":"2026-10-08T14:30:00.000Z","summary":"All enterprises conduct security awareness training for their employees.  But whether this has tangible benefits is debatable.","url":"https://www.securityweek.com/security-awareness-training-isnt-dead-but-it-needs-a-rethink/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49788"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/security-awareness-training-isnt-dead-but-it-needs-a-rethink/"}],"epss":null},{"id":"CVE-2026-91844","title":"CVE-2026-91844 — Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreig","summary":"Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.6.","source":"NVD","date":"2026-10-08T14:17:02.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91844","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-91844"],"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-91844"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91844"}],"epss":null},{"id":"CVE-2026-89290","title":"CVE-2026-89290 — Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri I","summary":"Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.\n\nThis issue affects eimzamip: from v1.6.4 before v1.6.7.","source":"NVD","date":"2026-10-08T14:17:02.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89290","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89290"],"cvss":{"score":3.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-89290"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89290"}],"epss":null},{"id":"CVE-2026-88257","title":"CVE-2026-88257 — Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client ","summary":"Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_mcp allows an MCP client to reach a tool's dispatch function with arguments that violate the input schema the server advertised. BeamMCP.Schema.validate/2 checked type, required, additionalProperties, enum and numeric bounds on the top-level arguments object only. Constraints inside nested objects and on array items (items, minItems, maxItems, minLength, maxLength, pattern, nested required, enum and additionalProperties: false) were advertised by tools/list and never checked at tools/call or prompts/get, and keywords outside the enforced subset (oneOf, anyOf, $ref) were advertised and ignored.\n\nA host whose dispatch code relies on the schema it declared receives values the schema forbids, such as an out-of-range number or an undeclared key inside a nested obje","source":"NVD","date":"2026-10-08T14:17:01.613Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88257","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-88257"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-88257"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88257"}],"epss":null},{"id":"CVE-2026-42698","title":"CVE-2026-42698 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.","source":"NVD","date":"2026-10-08T14:16:54.857Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42698","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-42698"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-42698"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42698"}],"epss":null},{"id":"CVE-2026-27420","title":"CVE-2026-27420 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kat","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.","source":"NVD","date":"2026-10-08T14:16:54.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27420","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-27420"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-27420"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27420"}],"epss":null},{"id":"CVE-2026-16167","title":"CVE-2026-16167 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper bounds checking.","source":"NVD","date":"2026-10-08T14:16:53.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16167","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16167"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16167"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16167"}],"epss":null},{"id":"CVE-2026-16165","title":"CVE-2026-16165 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a null pointer dereference.","source":"NVD","date":"2026-10-08T14:16:53.557Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16165","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16165"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16165"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16165"}],"epss":null},{"id":"CVE-2026-16164","title":"CVE-2026-16164 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a buffer overflow.","source":"NVD","date":"2026-10-08T14:16:53.373Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16164","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16164"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16164"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16164"}],"epss":null},{"id":"CVE-2026-16163","title":"CVE-2026-16163 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause memory corruption due to an out-of-bounds write.","source":"NVD","date":"2026-10-08T14:16:53.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16163","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16163"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16163"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16163"}],"epss":null},{"id":"CVE-2026-16161","title":"CVE-2026-16161 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.","source":"NVD","date":"2026-10-08T14:16:53.063Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16161","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16161"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16161"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16161"}],"epss":null},{"id":"CVE-2026-16159","title":"CVE-2026-16159 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.","source":"NVD","date":"2026-10-08T14:16:52.920Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16159","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16159"],"cvss":{"score":8.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16159"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16159"}],"epss":null},{"id":"CVE-2026-16111","title":"CVE-2026-16111 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a type confusion flaw.","source":"NVD","date":"2026-10-08T14:16:52.780Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16111","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16111"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16111"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16111"}],"epss":null},{"id":"CVE-2026-15824","title":"CVE-2026-15824 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.","source":"NVD","date":"2026-10-08T14:16:52.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15824","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15824"],"cvss":{"score":8.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15824"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15824"}],"epss":null},{"id":"CVE-2026-15822","title":"CVE-2026-15822 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper memoization of GraphQL fragment spreads.","source":"NVD","date":"2026-10-08T14:16:52.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15822","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15822"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15822"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15822"}],"epss":null},{"id":"CVE-2026-15819","title":"CVE-2026-15819 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to out-of-bounds memory access caused by a strict-weak-ordering violation in a sorting comparator.","source":"NVD","date":"2026-10-08T14:16:52.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15819","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15819"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15819"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15819"}],"epss":null},{"id":"CVE-2026-15784","title":"CVE-2026-15784 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.","source":"NVD","date":"2026-10-08T14:16:52.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15784","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15784"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15784"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15784"}],"epss":null},{"id":"CVE-2026-15781","title":"CVE-2026-15781 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow.","source":"NVD","date":"2026-10-08T14:16:52.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15781","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15781"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15781"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15781"}],"epss":null},{"id":"CVE-2026-15762","title":"CVE-2026-15762 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.","source":"NVD","date":"2026-10-08T14:16:51.880Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15762","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-15762"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-15762"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15762"}],"epss":null},{"id":"CVE-2026-14990","title":"CVE-2026-14990 — IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerabilit","summary":"IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.","source":"NVD","date":"2026-10-08T14:16:51.603Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14990","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14990"],"cvss":{"score":9.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14990"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14990"}],"epss":null},{"id":"CVE-2026-107615","title":"CVE-2026-107615 — An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 a","summary":"An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init() (and ThemeLib) load screenhooks32.dll / screenhooks64.dll with LoadLibrary() using a bare file name and no LOAD_LIBRARY_SEARCH_* flags, so the TightVNC service follows the default DLL search order and loads an attacker-planted DLL from a writable directory earlier in that order (for example, an installation directory with permissive ACLs).","source":"NVD","date":"2026-10-08T14:16:50.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107615","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107615"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107615"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107615"}],"epss":null},{"id":"CVE-2026-107614","title":"CVE-2026-107614 — An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows be","summary":"An integer underflow in WinCursorShapeUtils::trimTransparent() in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI capture path. The loop bound width - 1 wraps to 0xFFFFFFFF, producing an access roughly 4 GB beyond the 64 KB cursor buffer; a monochrome cursor of height 1 also becomes 0 because getCursorHeight() halves the height in place.","source":"NVD","date":"2026-10-08T14:16:50.163Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107614","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107614"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107614"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107614"}],"epss":null},{"id":"CVE-2026-107613","title":"CVE-2026-107613 — A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server fo","summary":"A NULL pointer dereference vulnerability in the Win8ScreenDriver component of GlavSoft TightVNC Server for Windows before 2.8.88 allows an attacker to crash the server, causing a denial of service. When re-initialization of the DXGI Desktop Duplication driver fails in applyNewScreenProperties() (for example after a GPU reset, display hot-plug or session change), m_drvImpl is left NULL and is subsequently dereferenced without a check by executeDetection(), getScreenBuffer(), grabFb(), getScreenPropertiesChanged() and getCursorPosition().","source":"NVD","date":"2026-10-08T14:16:50.020Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107613","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107613"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107613"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107613"}],"epss":null},{"id":"CVE-2026-107612","title":"CVE-2026-107612 — Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local auth","summary":"Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a time-seeded srand(time(0)) value that is predictable to one-second granularity. A low-privileged local process can open the mapping and tamper with the IPC channel of a service running as SYSTEM, potentially leading to disclosure of session data, privilege escalation, or denial of service.","source":"NVD","date":"2026-10-08T14:16:49.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107612","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107612"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107612"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107612"}],"epss":null},{"id":"CVE-2026-107611","title":"CVE-2026-107611 — An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.","summary":"An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Viewer for Windows before 2.8.88 allows a malicious or compromised VNC server to read heap memory beyond the palette allocation and crash the viewer by sending ZRLE-encoded tiles whose palette indices exceed the declared palette size. readPaletteRleTile() and readPackedPaletteTile() use the attacker-supplied index to look up colours without validating it against the palette size; out-of-bounds heap data is copied into the framebuffer (garbled display) or the read faults, terminating the viewer.","source":"NVD","date":"2026-10-08T14:16:49.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107611","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107611"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-107611"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107611"}],"epss":null},{"id":"CVE-2026-104634","title":"CVE-2026-104634 — Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP","summary":"Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp allows an MCP client's JSON true, false and null tool arguments to reach the host's dispatch function as the strings \"true\", \"false\" and \"nil\". After BeamMCP.Schema.validate/2 accepted a value as a boolean, normalize_arguments/2 passed every argument through to_json_value/1, whose atom clause converts true, false and nil to strings. A string is truthy in Elixir, so a host that tests a boolean argument, for example if args.dry_run, takes the opposite branch for false, and a guard such as confirm: false reads as set.\n\nThe client controls the argument and could send true directly, so the practical impact is limited to hosts whose behaviour on false differs from their behaviour on true, and to any policy layer in front of the server that permits false ","source":"NVD","date":"2026-10-08T14:16:46.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104634","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104634"],"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},"read":false,"kev":false,"recordIds":["CVE-2026-104634"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104634"}],"epss":null},{"id":"CVE-2026-103663","title":"CVE-2026-103663 — Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of laye","summary":"Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. \n\nCritically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root.\n\n\nThis issue was fixed in version 0.35.0.","source":"NVD","date":"2026-10-08T14:16:46.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103663"],"cvss":{"score":9.4,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cvd@cert.pl"},"read":false,"kev":false,"recordIds":["CVE-2026-103663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103663"}],"epss":null},{"id":"https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html","title":"ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms","source":"The Hacker News","date":"2026-10-08T14:12:34.000Z","summary":"Cybersecurity researchers have disclosed details of a targeted campaign aimed at South Korean financial organizations that used an artificial intelligence (AI) pen testing tool named ARTEX to carry out the attacks.  The activity, per CrowdStrike Intelligence, was active from late September to early October 2026, and resulted in data exfiltration from various South Korea-based financial firms,","url":"https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49879","title":"Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication","source":"SecurityWeek","date":"2026-10-08T14:04:44.000Z","summary":"Threat actors have started targeting CVE-2026-21589, a critical vulnerability in Atlassian’s self-hosted Data Center products.  The post Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication appeared first on SecurityWeek .","url":"https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49879"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/attackers-target-critical-atlassian-vulnerability-within-hours-of-poc-publication/"}],"epss":null},{"id":"CVE-2026-66479","title":"CVE-2026-66479 — Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows St","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.","source":"NVD","date":"2026-10-08T13:17:18.707Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66479","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66479"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-66479"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66479"}],"epss":null},{"id":"CVE-2026-62142","title":"CVE-2026-62142 — Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forg","summary":"Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.","source":"NVD","date":"2026-10-08T13:17:18.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62142","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62142"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62142"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62142"}],"epss":null},{"id":"CVE-2026-62128","title":"CVE-2026-62128 — Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly C","summary":"Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.","source":"NVD","date":"2026-10-08T13:17:18.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62128","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62128"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62128"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62128"}],"epss":null},{"id":"CVE-2026-62127","title":"CVE-2026-62127 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Med","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.","source":"NVD","date":"2026-10-08T13:17:18.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62127","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-62127"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-62127"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62127"}],"epss":null},{"id":"CVE-2026-44038","title":"CVE-2026-44038 — A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, li","summary":"A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.","source":"NVD","date":"2026-10-08T13:17:17.963Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44038","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44038"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44038"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44038"}],"epss":null},{"id":"CVE-2026-44037","title":"CVE-2026-44037 — Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and Dc","summary":"Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.","source":"NVD","date":"2026-10-08T13:17:17.817Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44037","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44037"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44037"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44037"}],"epss":null},{"id":"CVE-2026-44036","title":"CVE-2026-44036 — Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSeque","summary":"Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements. The xml2dcm tool and any service that converts untrusted XML to DICOM with this code are affected. The issue is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.","source":"NVD","date":"2026-10-08T13:17:17.653Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44036","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44036"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44036"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44036"}],"epss":null},{"id":"CVE-2026-44035","title":"CVE-2026-44035 — Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.","summary":"Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.","source":"NVD","date":"2026-10-08T13:17:17.497Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44035","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44035"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44035"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44035"}],"epss":null},{"id":"CVE-2026-44034","title":"CVE-2026-44034 — A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFF","summary":"A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. Applications that decode RLE images frame by frame (for example, through DcmPixelData::getUncompressedFrame()) are affected. The dcmdrle command-line tool uses decode() and is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d.","source":"NVD","date":"2026-10-08T13:17:17.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44034","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44034"],"cvss":{"score":4.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44034"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44034"}],"epss":null},{"id":"CVE-2026-44033","title":"CVE-2026-44033 — Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parse","summary":"Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.","source":"NVD","date":"2026-10-08T13:17:17.197Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44033","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44033"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44033"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44033"}],"epss":null},{"id":"CVE-2026-44031","title":"CVE-2026-44031 — Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS ","summary":"Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).","source":"NVD","date":"2026-10-08T13:17:17.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44031","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-44031"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"33c584b5-0579-4c06-b2a0-8d8329fcab9c"},"read":false,"kev":false,"recordIds":["CVE-2026-44031"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44031"}],"epss":null},{"id":"CVE-2026-19218","title":"CVE-2026-19218 — Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Ex","summary":"Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation.\n\nThis issue affects MyRezzta: from 2.06.03 before 2.07.01.","source":"NVD","date":"2026-10-08T13:17:16.753Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19218","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19218"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-19218"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19218"}],"epss":null},{"id":"CVE-2026-16340","title":"CVE-2026-16340 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.","source":"NVD","date":"2026-10-08T13:17:16.610Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16340","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16340"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16340"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16340"}],"epss":null},{"id":"CVE-2026-16182","title":"CVE-2026-16182 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 throug","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a denial of service due to a NULL pointer dereference in GraphQL variable processing.","source":"NVD","date":"2026-10-08T13:17:16.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16182","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16182"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16182"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16182"}],"epss":null},{"id":"CVE-2026-16181","title":"CVE-2026-16181 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to bypass security restrictions due to improper authorization.","source":"NVD","date":"2026-10-08T13:17:16.340Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16181","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16181"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16181"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16181"}],"epss":null},{"id":"CVE-2026-16179","title":"CVE-2026-16179 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an attacker to cause a heap buffer underwrite and potentially crash the service.","source":"NVD","date":"2026-10-08T13:17:16.200Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16179","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16179"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16179"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16179"}],"epss":null},{"id":"CVE-2026-16178","title":"CVE-2026-16178 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper input validation.","source":"NVD","date":"2026-10-08T13:17:16.067Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16178","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16178"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16178"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16178"}],"epss":null},{"id":"CVE-2026-16177","title":"CVE-2026-16177 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.","source":"NVD","date":"2026-10-08T13:17:15.933Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16177","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16177"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16177"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16177"}],"epss":null},{"id":"CVE-2026-16176","title":"CVE-2026-16176 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to improper validation of the length field during memory reallocation.","source":"NVD","date":"2026-10-08T13:17:15.797Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16176","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16176"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16176"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16176"}],"epss":null},{"id":"CVE-2026-16170","title":"CVE-2026-16170 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.","source":"NVD","date":"2026-10-08T13:17:15.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16170","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16170"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16170"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16170"}],"epss":null},{"id":"CVE-2026-16169","title":"CVE-2026-16169 — IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of servic","summary":"IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","source":"NVD","date":"2026-10-08T13:17:15.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16169","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-16169"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-16169"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16169"}],"epss":null},{"id":"CVE-2026-14521","title":"CVE-2026-14521 — IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and ","summary":"IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.","source":"NVD","date":"2026-10-08T13:17:15.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14521","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-14521"],"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"psirt@us.ibm.com"},"read":false,"kev":false,"recordIds":["CVE-2026-14521"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14521"}],"epss":null},{"id":"CVE-2026-106611","title":"CVE-2026-106611 — Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Reque","summary":"Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.","source":"NVD","date":"2026-10-08T13:17:15.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106611","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106611"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106611"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106611"}],"epss":null},{"id":"CVE-2026-106603","title":"CVE-2026-106603 — Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows ","summary":"Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.","source":"NVD","date":"2026-10-08T13:17:14.877Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106603","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106603"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106603"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106603"}],"epss":null},{"id":"CVE-2026-106600","title":"CVE-2026-106600 — Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly C","summary":"Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through 4.18.0.","source":"NVD","date":"2026-10-08T13:17:14.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106600","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106600"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106600"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106600"}],"epss":null},{"id":"CVE-2026-106596","title":"CVE-2026-106596 — Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer all","summary":"Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Composer Website Builder: from n/a through 45.16.3.","source":"NVD","date":"2026-10-08T13:17:14.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106596","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-106596"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-106596"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106596"}],"epss":null},{"id":"CVE-2026-105893","title":"CVE-2026-105893 — Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets ev","summary":"Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.","source":"NVD","date":"2026-10-08T13:17:14.210Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105893","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105893"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105893"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105893"}],"epss":null},{"id":"CVE-2026-105891","title":"CVE-2026-105891 — Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiti","summary":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.","source":"NVD","date":"2026-10-08T13:17:14.070Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105891","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105891"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105891"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105891"}],"epss":null},{"id":"CVE-2026-105890","title":"CVE-2026-105890 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liq","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.","source":"NVD","date":"2026-10-08T13:17:13.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105890","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105890"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105890"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105890"}],"epss":null},{"id":"CVE-2026-105888","title":"CVE-2026-105888 — Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiti","summary":"Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.","source":"NVD","date":"2026-10-08T13:17:13.790Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105888","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105888"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105888"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105888"}],"epss":null},{"id":"CVE-2026-105887","title":"CVE-2026-105887 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rob","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 5.1.6.","source":"NVD","date":"2026-10-08T13:17:13.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105887","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105887"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105887"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105887"}],"epss":null},{"id":"CVE-2026-105886","title":"CVE-2026-105886 — Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Inc","summary":"Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Post Kit: from n/a through 4.5.5.","source":"NVD","date":"2026-10-08T13:17:13.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105886","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105886"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105886"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105886"}],"epss":null},{"id":"CVE-2026-105878","title":"CVE-2026-105878 — Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bun","summary":"Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0.","source":"NVD","date":"2026-10-08T13:17:13.187Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105878","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105878"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105878"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105878"}],"epss":null},{"id":"CVE-2026-105079","title":"CVE-2026-105079 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sty","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.","source":"NVD","date":"2026-10-08T13:17:13.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105079","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105079"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105079"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105079"}],"epss":null},{"id":"CVE-2026-105078","title":"CVE-2026-105078 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.","source":"NVD","date":"2026-10-08T13:17:12.903Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105078","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105078"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105078"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105078"}],"epss":null},{"id":"CVE-2026-105076","title":"CVE-2026-105076 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in App","summary":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.","source":"NVD","date":"2026-10-08T13:17:12.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105076","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105076"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105076"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105076"}],"epss":null},{"id":"CVE-2026-103072","title":"CVE-2026-103072 — Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incor","summary":"Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.","source":"NVD","date":"2026-10-08T13:17:12.300Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103072","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103072"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103072"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103072"}],"epss":null},{"id":"CVE-2026-103070","title":"CVE-2026-103070 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sho","summary":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.","source":"NVD","date":"2026-10-08T13:17:12.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103070","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103070"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","source":"audit@patchstack.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103070"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103070"}],"epss":null},{"id":"CVE-2026-102784","title":"CVE-2026-102784 — Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesControll","summary":"Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox < 2.20.4.0 - PagesController uses a trait that validates the Joomla session token only when the HTTP method is POST. addLanguage does not require POST inside the action and reads url and zip through the generic request input. A GET request can therefore reach the action without the trait checking a token. The action still requires core.tools , but that is the victim’s permission check; it does not prove that the privileged user intended the request.","source":"NVD","date":"2026-10-08T13:17:12.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102784","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102784"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@joomla.org"},"read":false,"kev":false,"recordIds":["CVE-2026-102784"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102784"}],"epss":null},{"id":"CVE-2026-102783","title":"CVE-2026-102783 — Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains th","summary":"Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than pr","source":"NVD","date":"2026-10-08T13:17:11.847Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102783","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102783"],"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@joomla.org"},"read":false,"kev":false,"recordIds":["CVE-2026-102783"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102783"}],"epss":null},{"id":"https://www.securityweek.com/?p=49876","title":"US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward","source":"SecurityWeek","date":"2026-10-08T12:46:21.000Z","summary":"Zhang Yu was charged alongside Xu Zewei, who was extradited from Italy to the US in April 2026.  The post US Seeks Alleged Chinese Hafnium Hacker With $10 Million Reward appeared first on SecurityWeek .","url":"https://www.securityweek.com/us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49876"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/us-seeks-alleged-chinese-hafnium-hacker-with-10-million-reward/"}],"epss":null},{"id":"https://www.securityweek.com/?p=49874","title":"SonicWall and Splunk Patch Critical Vulnerabilities","source":"SecurityWeek","date":"2026-10-08T12:37:32.000Z","summary":"Critical and high-severity vulnerabilities could allow attackers to bypass authentication, execute arbitrary code, and elevate their privileges.  The post SonicWall and Splunk Patch Critical Vulnerabilities appeared first on SecurityWeek .","url":"https://www.securityweek.com/sonicwall-and-splunk-patch-critical-vulnerabilities/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49874"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/sonicwall-and-splunk-patch-critical-vulnerabilities/"}],"epss":null},{"id":"CVE-2026-92555","title":"CVE-2026-92555 — Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export I","summary":"Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources.\n\nThis issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.","source":"NVD","date":"2026-10-08T12:17:18.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92555","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92555"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-92555"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92555"}],"epss":null},{"id":"CVE-2026-19083","title":"CVE-2026-19083 — Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export In","summary":"Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects OctoCloud: from 1.12.06 before 1.12.07.","source":"NVD","date":"2026-10-08T12:17:17.500Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19083","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-19083"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"iletisim@usom.gov.tr"},"read":false,"kev":false,"recordIds":["CVE-2026-19083"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19083"}],"epss":null},{"id":"CVE-2026-107587","title":"CVE-2026-107587 — Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allow","summary":"Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.","source":"NVD","date":"2026-10-08T12:17:16.937Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107587","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107587"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107587"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107587"}],"epss":null},{"id":"CVE-2026-107584","title":"CVE-2026-107584 — Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SM","summary":"Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to outbound SMTP delivery. The server's validating DNSSEC resolver treated a TLSA or MX lookup that did not complete (no answer, SERVFAIL, a malformed reply), an answer without the requested records and without an NSEC/NSEC3 proof of their absence, and an answer whose records carried no applicable RRSIG as if the recipient domain were unsigned, and from 6.2.19 it also delivered to mail exchangers taken from an unvalidated MX lookup that the DNSSEC-validated MX record set did not name. An attacker who can drop, forge or strip DNS answers on the path to the server's resolver, at the resolver, or between the resolver and the recipient domain's name servers, and who holds an active position on the SMTP path, can thereby disable DANE for a DNSSEC-signed ","source":"NVD","date":"2026-10-08T12:17:16.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107584","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107584"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107584"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107584"}],"epss":null},{"id":"CVE-2026-107583","title":"CVE-2026-107583 — Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMa","summary":"Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once. A message whose HTML refers to one small embedded image a very large number of times, opened in the webmail by its recipient, therefore keeps one of the listener's four worker threads busy for minutes and makes it build a document of gigabytes, so that a few such messages leave the HTTP listener unable to answ","source":"NVD","date":"2026-10-08T12:17:16.633Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107583","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107583"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107583"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107583"}],"epss":null},{"id":"CVE-2026-107582","title":"CVE-2026-107582 — Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6","summary":"Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number. A received HTML-only message holding a very large number of entity references therefore keeps one of the listener's four worker threads busy for minutes or longer each time the recipient's webmail lists the folder, without the message being opened, so that a few such listings leave the HTTP listener unable to ","source":"NVD","date":"2026-10-08T12:17:16.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107582","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107582"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107582"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107582"}],"epss":null},{"id":"CVE-2026-107581","title":"CVE-2026-107581 — Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in accoun","summary":"Progressive Robot hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position, so a long SEARCH TEXT key over a message cost the product of the two lengths; SEARCH message sets and the saved-result marker ($), SORT criteria, HEADER.FIELDS name lists and UID ranges were each read once per message rather than once per command; and a FETCH naming a message's sections very many time","source":"NVD","date":"2026-10-08T12:17:16.320Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107581","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107581"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107581"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107581"}],"epss":null},{"id":"CVE-2026-107580","title":"CVE-2026-107580 — Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailSer","summary":"Inefficient algorithmic complexity in the decoding of message header fields in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks, and an RFC 2047 encoded word may decode to any number of them. A received message whose Subject or other header field holds such a value keeps a worker thread busy for minutes or longer each time the value is read: when the recipient's IMAP client searches, sorts or threads the folder by a header, when the webmail lists the folder, and, where configured, when a rule tes","source":"NVD","date":"2026-10-08T12:17:16.123Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107580","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107580"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107580"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107580"}],"epss":null},{"id":"CVE-2026-107579","title":"CVE-2026-107579 — Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServe","summary":"Inefficient algorithmic complexity in the bounce and complaint processing of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to stop mail delivery by sending messages, when bounce processing or complaint processing is enabled or a mailing list is managed by the server (none is by default). The readers of incoming delivery status notifications (RFC 3464) and abuse feedback reports (RFC 5965) removed the blank lines at the start of the returned headers part two bytes at a time, copying the rest of the part each time, so their work grew with the square of the number of blank lines. A message shaped like such a report, whose headers part begins with a very large number of blank lines within the reader's 2 MB limit, keeps a delivery thread busy for over a minute while it is delivered, and a few such messa","source":"NVD","date":"2026-10-08T12:17:15.940Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107579","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107579"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107579"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107579"}],"epss":null},{"id":"CVE-2026-107578","title":"CVE-2026-107578 — Improper link resolution and external control of file paths in the administrative command-line operations","summary":"Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from th","source":"NVD","date":"2026-10-08T12:17:15.787Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107578","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107578"],"cvss":{"score":6.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107578"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107578"}],"epss":null},{"id":"CVE-2026-107577","title":"CVE-2026-107577 — Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages","summary":"Inefficient algorithmic complexity and a non-terminating loop in the MIME processing of received messages in Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote unauthenticated attacker to make the mail services unavailable by sending a message. Removing a MIME header parameter whose value is empty and directly followed by a semicolon (for example a Content-Disposition with 'filename=a.bat; filename=;') entered a loop that never terminates, holding a worker thread at full load until the server is restarted; this is reached when the attachment blocker renames a blocked attachment or a filename is set over the REST API. Separately, decoding a header field that holds many RFC 2047 encoded words of an encoding other than base64 or quoted-printable, removing a parameter with many RFC 2231 continuations, and deleting many header fi","source":"NVD","date":"2026-10-08T12:17:15.630Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107577","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107577"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107577"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107577"}],"epss":null},{"id":"CVE-2026-107576","title":"CVE-2026-107576 — Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robo","summary":"Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header: the 'simple' canonicalisation prepended each continuation line of a folded field to the lines already gathered, and both canonicalisations searched the gathered fields from the bottom for each h= name and erased the match from the middle of the list. A message whose header holds very many fields, or a field folded over very many lines, with a DKIM-Signature the attacker signs for a domain they control, keeps a worker thread busy for tens of seconds per sig","source":"NVD","date":"2026-10-08T12:17:15.487Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107576","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107576"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107576"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107576"}],"epss":null},{"id":"CVE-2026-107575","title":"CVE-2026-107575 — Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and ","summary":"Inefficient algorithmic complexity in the SPF macro expansion of Progressive Robot hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 section 7.1 requires a name too long to look up to lose whole labels from the left; the server did this by removing one label at a time and copying the rest of the name each time, so the work grew with the square of the expansion. An attacker who publishes an SPF record for a domain they control, with a mechanism whose domain-spec expands through macros to a name far longer than 253 characters, makes the SPF check of a message from that domain take several seconds. The expansion is bounded by SPF's own per-term and per-macro limits, so the loss of availability is partial.","source":"NVD","date":"2026-10-08T12:17:15.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107575"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107575"}],"epss":null},{"id":"CVE-2026-107574","title":"CVE-2026-107574 — Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote un","summary":"Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a remote unauthenticated attacker to make the mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds against the affected code. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail, local or outbound, for over an hour per report. A signed-in account reaches the same 16 MB body through the webmail's own REST routes, holding ","source":"NVD","date":"2026-10-08T12:17:15.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107574","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107574"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107574"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107574"}],"epss":null},{"id":"CVE-2026-107573","title":"CVE-2026-107573 — Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3","summary":"Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with the permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it. The Linux AppImage of 6.3.0 thro","source":"NVD","date":"2026-10-08T12:17:15.027Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107573","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107573"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107573"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107573"}],"epss":null},{"id":"CVE-2026-107572","title":"CVE-2026-107572 — Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3","summary":"Inefficient complexity in the Sieve filter evaluation of Progressive Robot hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make the mail services unavailable with their own filter. A ':matches' pattern was matched by a backtracking descent whose time grew with the matched value's length raised to the number of wildcards, so a pattern such as '*a*a*a*b' over 800 characters took 44 seconds; and 'deleteheader' erased the fields it removed one at a time, so removing many fields of one name over a message's header cost O(N^2) (80,000 fields took 18.8 seconds). Sieve filters run on the small, shared delivery thread pool, so an account holder whose active script does this, fed a few messages they can send themselves, empties the pool and stops delivery for the whole server. The script is the account holder's own and ca","source":"NVD","date":"2026-10-08T12:17:14.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107572","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107572"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107572"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107572"}],"epss":null},{"id":"CVE-2026-107570","title":"CVE-2026-107570 — heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write w","summary":"heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.","source":"NVD","date":"2026-10-08T12:17:14.717Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107570","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107570"],"cvss":{"score":2.5,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107570"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107570"}],"epss":null},{"id":"CVE-2026-107275","title":"CVE-2026-107275 — @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time ","summary":"@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it.","source":"NVD","date":"2026-10-08T12:17:14.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107275","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107275"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"ce714d77-add3-4f53-aff5-83d477b104bb"},"read":false,"kev":false,"recordIds":["CVE-2026-107275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107275"}],"epss":null},{"id":"CVE-2026-93509","title":"CVE-2026-93509 — The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer ","summary":"The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.","source":"NVD","date":"2026-10-08T11:16:47.217Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93509","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93509"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93509"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93509"}],"epss":null},{"id":"CVE-2026-105190","title":"CVE-2026-105190 — The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration se","summary":"The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.","source":"NVD","date":"2026-10-08T11:16:44.607Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105190","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105190"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105190"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105190"}],"epss":null},{"id":"CVE-2026-104704","title":"CVE-2026-104704 — Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a ma","summary":"Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.","source":"NVD","date":"2026-10-08T11:16:44.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104704","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104704"],"cvss":{"score":7.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104704"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104704"}],"epss":null},{"id":"CVE-2026-104671","title":"CVE-2026-104671 — The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in on","summary":"The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.","source":"NVD","date":"2026-10-08T11:16:44.303Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104671","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104671"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104671"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104671"}],"epss":null},{"id":"CVE-2026-104660","title":"CVE-2026-104660 — Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) ","summary":"Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCOM access or launch permission and calls CoInitializeSecurity with no security descriptor, so any user logged on at the console or over Remote Desktop can activate the classes in the running service; a hMailServer.Message, its Attachments and Attachment, and a hMailServer.FetchAccount created this way carry a credential that never authenticated. Attachments.Add(path) and Attachment.SaveAs(path) performed no authorization check, and Message.Save/Copy and FetchAccount.AccountID/Save performed none either up to 6.3.3 and from 6.3.4 treated a holder ","source":"NVD","date":"2026-10-08T11:16:44.160Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104660"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104660"}],"epss":null},{"id":"CVE-2026-104659","title":"CVE-2026-104659 — Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API li","summary":"Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.","source":"NVD","date":"2026-10-08T11:16:44.013Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104659","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104659"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104659"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104659"}],"epss":null},{"id":"CVE-2026-104658","title":"CVE-2026-104658 — The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 ","summary":"The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit to stop before reading the service account's files. An attacker who already runs code as the hmailserver service account, for example through another flaw in the mail server, can therefore have arbitrary code executed as root, on any Linux installation where the live update's path unit is active - the default for the project's .deb and .rpm packages - and on AppImage installations run under that unit.","source":"NVD","date":"2026-10-08T11:16:43.870Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104658","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104658"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-104658"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104658"}],"epss":null},{"id":"CVE-2026-103649","title":"CVE-2026-103649 — Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a","summary":"Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5 allow a remote attacker to hold server threads indefinitely and so stop outbound mail delivery (denial of service). The server set its socket timeouts in the form Windows takes, which Linux refuses, and its HTTPS clients read without a deadline, so a peer that accepts a connection and then sends nothing held the waiting thread for as long as the connection stayed open. The MTA-STS policy fetch, enabled by default, is made during outbound delivery to mta-sts.<recipient domain>, so anyone who can make the server deliver mail to a domain they control - for example as the envelope sender of a message that bounces - can hold delivery threads until outbound delivery stops. The same flaw affects the DANE TLSA query, the OAuth2 token request, the ACM","source":"NVD","date":"2026-10-08T11:16:43.093Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103649","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103649"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103649"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103649"}],"epss":null},{"id":"CVE-2026-103647","title":"CVE-2026-103647 — Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote ","summary":"Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.","source":"NVD","date":"2026-10-08T11:16:42.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103647","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103647"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103647"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103647"}],"epss":null},{"id":"CVE-2026-103517","title":"CVE-2026-103517 — The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming pay","summary":"The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying.","source":"NVD","date":"2026-10-08T11:16:42.613Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103517","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103517"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"contact@wpscan.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103517"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103517"}],"epss":null},{"id":"CVE-2026-103011","title":"CVE-2026-103011 — Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called b","summary":"Heap-based buffer overflow in the legacy Blowfish encryption routine (BlowFishEncryptor::Encode, called by EncryptToString) in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows an authenticated mailbox user to cause a denial of service (service crash), and possibly other unspecified impact. In 6.3.4 and 6.3.5, where the self-service REST API is enabled (it is off by default), the user does this remotely by adding a fetch account whose password is 129 to 247 characters long and not a multiple of 8, and then requesting their personal data export (GET /api/v1/me/export.zip), which encrypts that password with the legacy scheme. The same flaw is reachable on Windows by any local interactive user with no hMailServer credentials, through the COM method Utilities.BlowfishEncrypt, which checked no authentication. It is also reachable by eve","source":"NVD","date":"2026-10-08T11:16:42.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103011","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103011"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103011"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103011"}],"epss":null},{"id":"CVE-2026-103010","title":"CVE-2026-103010 — Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromStrin","summary":"Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEncryptor::DecryptFromString) in Progressive Robot hMailServer 6.0.0 through 6.3.3 on Windows allows a local interactive user with no hMailServer credentials to write bytes of their choosing past the end of a 255-byte heap buffer in the hMailServer service process, which runs as LocalSystem by default. The user does this by passing a long hexadecimal string to the COM method Utilities.BlowfishDecrypt, which checked no authentication. The routine converted hexadecimal input of any length into a fixed 255-byte buffer before decrypting it in place. The result is a denial of service (service crash), and possibly code execution with the privileges of the service account.","source":"NVD","date":"2026-10-08T11:16:42.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103010","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103010"],"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-103010"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103010"}],"epss":null},{"id":"https://www.securityweek.com/?p=49872","title":"Rein Security Raises $25 Million to Guard AI Agents at Runtime","source":"SecurityWeek","date":"2026-10-08T11:11:28.000Z","summary":"The cybersecurity startup will invest in product innovation, agentic research, and employee base expansion.  The post Rein Security Raises $25 Million to Guard AI Agents at Runtime appeared first on SecurityWeek .","url":"https://www.securityweek.com/rein-security-raises-25-million-to-guard-ai-agents-at-runtime/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49872"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/rein-security-raises-25-million-to-guard-ai-agents-at-runtime/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html","title":"Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia","source":"The Hacker News","date":"2026-10-08T10:30:00.000Z","summary":"Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials.  Attackers are increasingly building filtering, session management, and traffic controls into the infrastructure that delivers the phishing page itself.","url":"https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/wazza-phishkit-targets-banking.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49870","title":"TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws","source":"SecurityWeek","date":"2026-10-08T10:24:04.000Z","summary":"SEC Consult has published technical details on vulnerabilities mentioned in a complaint filed by several US states.  The post TP-Link Faces State Lawsuits and New Scrutiny Over ISP Router Flaws appeared first on SecurityWeek .","url":"https://www.securityweek.com/tp-link-faces-state-lawsuits-and-new-scrutiny-over-isp-router-flaws/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49870"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/tp-link-faces-state-lawsuits-and-new-scrutiny-over-isp-router-flaws/"}],"epss":null},{"id":"CVE-2026-107510","title":"CVE-2026-107510 — An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privil","summary":"An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation.","source":"NVD","date":"2026-10-08T10:17:09.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107510","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107510"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"f84ca5ce-fbe7-4668-8724-994599108a02"},"read":false,"kev":false,"recordIds":["CVE-2026-107510"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107510"}],"epss":null},{"id":"CVE-2026-107503","title":"CVE-2026-107503 — Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover v","summary":"Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft.","source":"NVD","date":"2026-10-08T10:17:08.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107503","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107503"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"emo@eclipse.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107503"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107503"}],"epss":null},{"id":"https://cyberscoop.com/?p=90996","title":"Quantum computers could break today’s encryption. Washington needs to prepare now.","source":"CyberScoop","date":"2026-10-08T10:00:00.000Z","summary":"As advances lower the barrier to breaking current encryption, Washington must move with equal urgency on post-quantum defenses.  The post Quantum computers could break today’s encryption.","url":"https://cyberscoop.com/quantum-computers-could-break-todays-encryption-washington-needs-to-prepare-now/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://cyberscoop.com/?p=90996"],"sources":["CyberScoop"],"topics":["Cyber news"],"affected":[],"references":[{"source":"CyberScoop","url":"https://cyberscoop.com/quantum-computers-could-break-todays-encryption-washington-needs-to-prepare-now/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html","title":"16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases","source":"The Hacker News","date":"2026-10-08T09:46:32.000Z","summary":"Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases and private keys.  \"The extensions masquerade as wallet portals, desktop utilities, and browser tools, but their code intercepts recovery phrases and private keys during wallet import flows and attempts to send those secrets to","url":"https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/16-malicious-firefox-extensions-pose-as.html"}],"epss":null},{"id":"https://www.securityweek.com/?p=49868","title":"Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme","source":"SecurityWeek","date":"2026-10-08T09:27:55.000Z","summary":"Zohar Pinhasi was paying ransoms to obtain decryption keys and then charging victims substantially more for remediation.  The post Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme appeared first on SecurityWeek .","url":"https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49868"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/fake-decryption-tools-masked-11m-markup-in-ransomware-recovery-scheme/"}],"epss":null},{"id":"CVE-2026-89191","title":"CVE-2026-89191 — Unsanitised input in\nthe \"template name\" field of SQLView KRIS's Workflow Template feature\nis rendered in","summary":"Unsanitised input in\nthe \"template name\" field of SQLView KRIS's Workflow Template feature\nis rendered in \"onclick\" attributes on the main dashboard without\nproper server-side sanitisation, allowing an attacker with administrative\naccess to inject and store malicious scripts that execute in the browsers of\naffected users.","source":"NVD","date":"2026-10-08T09:16:42.413Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89191","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89191"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4"},"read":false,"kev":false,"recordIds":["CVE-2026-89191"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89191"}],"epss":null},{"id":"CVE-2026-71896","title":"CVE-2026-71896 — An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other us","summary":"An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions.\n\n\n\nThe endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view.\n\n\n\nSuccessful exploitation may expose sensitive user information and facilitate account enumeration.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.","source":"NVD","date":"2026-10-08T09:16:42.287Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71896","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-71896"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-71896"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71896"}],"epss":null},{"id":"CVE-2026-71895","title":"CVE-2026-71895 — An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retriev","summary":"An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler.\n\n\n\nThe impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster.\n\n\n\nThis issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.","source":"NVD","date":"2026-10-08T09:16:42.167Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71895","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-71895"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-71895"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71895"}],"epss":null},{"id":"CVE-2026-71183","title":"CVE-2026-71183 — An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain informatio","summary":"An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.\n\n\n\nThese endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.\n\n\n\nSuccessful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.","source":"NVD","date":"2026-10-08T09:16:42.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71183","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-71183"],"cvss":{"score":7.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-71183"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71183"}],"epss":null},{"id":"CVE-2026-66087","title":"CVE-2026-66087 — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate ta","summary":"An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the \n\n\n\n\n\n  *  /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop\n  *  /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint\n\n\n\n\n\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue.","source":"NVD","date":"2026-10-08T09:16:41.910Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66087","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66087"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-66087"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66087"}],"epss":null},{"id":"CVE-2026-66084","title":"CVE-2026-66084 — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify tas","summary":"An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint.\n\n\n\nThe endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies.\n\n\n\nThis vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to v","source":"NVD","date":"2026-10-08T09:16:41.783Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66084","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66084"],"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-66084"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66084"}],"epss":null},{"id":"CVE-2026-66082","title":"CVE-2026-66082 — An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform un","summary":"An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects.\n\n\n\nThe affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that project. An authenticated user with the required permissions in one project can supply that project's code together with a resource identifier from another project, bypassing the target project's access restrictions.\n\n\n\nThe affected endpoints include:\n\n  *  \n\nPOST /projects/{projectCode}/schedules/{id}/online and /offline: Activate or deactivate workflow schedules in another project.\n\n\n  *  \n\nPOST /projects/{projectCode}/workflow-definition/{code}/release: Change the ONLINE/OFFLINE state of workflo","source":"NVD","date":"2026-10-08T09:16:41.637Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66082","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-66082"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-66082"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66082"}],"epss":null},{"id":"CVE-2026-4894","title":"CVE-2026-4894 — A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authent","summary":"A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an unauthenticated remote attacker adds more than one email address.\nThe service processes the entire value as a valid list of recipients and sends the OTP code to all addresses without proper validation of all added emails (only one of them needs to be valid). Exploiting this vulnerability would allow an attacker to:\n\n  *  Obtain the authentication OTP;\n  *  Impersonate someone else in the registration process;\n  *  Register accounts using other people's email addresses without access to the mailbox;\n  *  Indirectly confirm the existence of already reg","source":"NVD","date":"2026-10-08T09:16:41.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4894","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-4894"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve-coordination@incibe.es"},"read":false,"kev":false,"recordIds":["CVE-2026-4894"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4894"}],"epss":null},{"id":"CVE-2026-12260","title":"CVE-2026-12260 — SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name","summary":"SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attackers to extract confidential information (such as the version and type of backend used), alter data or further compromise the CRM environment.","source":"NVD","date":"2026-10-08T09:16:41.087Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12260","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-12260"],"cvss":{"score":10,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve-coordination@incibe.es"},"read":false,"kev":false,"recordIds":["CVE-2026-12260"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12260"}],"epss":null},{"id":"CVE-2026-105110","title":"CVE-2026-105110 — OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthen","summary":"OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter.","source":"NVD","date":"2026-10-08T09:16:40.930Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105110","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105110"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"},"read":false,"kev":false,"recordIds":["CVE-2026-105110"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105110"}],"epss":null},{"id":"https://www.securityweek.com/?p=49866","title":"Oracle Health Data Breach Tally Climbs to Nearly 20 Million","source":"SecurityWeek","date":"2026-10-08T08:23:31.000Z","summary":"The figure is far higher than the counts that surfaced in earlier filings and patient notifications.  The post Oracle Health Data Breach Tally Climbs to Nearly 20 Million appeared first on SecurityWeek .","url":"https://www.securityweek.com/oracle-health-data-breach-tally-climbs-to-nearly-20-million/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49866"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/oracle-health-data-breach-tally-climbs-to-nearly-20-million/"}],"epss":null},{"id":"CVE-2026-93699","title":"CVE-2026-93699 — Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other account","summary":"Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.","source":"NVD","date":"2026-10-08T08:16:34.367Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93699","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-93699"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"support@hackerone.com"},"read":false,"kev":false,"recordIds":["CVE-2026-93699"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93699"}],"epss":null},{"id":"CVE-2026-107466","title":"CVE-2026-107466 — A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosur","summary":"A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.","source":"NVD","date":"2026-10-08T08:16:34.193Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107466","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107466"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107466"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107466"}],"epss":null},{"id":"https://www.securityweek.com/?p=49863","title":"FortiBleed Attackers Locking Victims Out of Fortinet Devices","source":"SecurityWeek","date":"2026-10-08T07:52:33.000Z","summary":"Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access.  The post FortiBleed Attackers Locking Victims Out of Fortinet Devices appeared first on SecurityWeek .","url":"https://www.securityweek.com/fortibleed-attackers-locking-victims-out-of-fortinet-devices/","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://www.securityweek.com/?p=49863"],"sources":["SecurityWeek"],"topics":["Cyber news"],"affected":[],"references":[{"source":"SecurityWeek","url":"https://www.securityweek.com/fortibleed-attackers-locking-victims-out-of-fortinet-devices/"}],"epss":null},{"id":"https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html","title":"U.S. Offers Up to $10 Million for Tips on Zhang Yu, Charged in HAFNIUM Hacks","source":"The Hacker News","date":"2026-10-08T07:42:04.000Z","summary":"S.  State Department is offering up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM.","url":"https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html"}],"epss":null},{"id":"https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html","title":"MonsterCloud Owner Accused of Billing Over $19M While Secretly Paying Ransoms to Decrypt Data","source":"The Hacker News","date":"2026-10-08T07:41:44.000Z","summary":"S.  S.","url":"https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/monstercloud-owner-accused-of-billing.html"}],"epss":null},{"id":"CVE-2026-87428","title":"CVE-2026-87428 — In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SA","summary":"In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management credentials for onboarded SANnav instances and compromise connected Brocade SANnav servers or managed Brocade Fibre Channel switches.","source":"NVD","date":"2026-10-08T07:16:33.400Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87428","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87428"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87428"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87428"}],"epss":null},{"id":"CVE-2026-87426","title":"CVE-2026-87426 — An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASC","summary":"An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.","source":"NVD","date":"2026-10-08T07:16:33.270Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87426","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87426"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87426"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87426"}],"epss":null},{"id":"CVE-2026-87425","title":"CVE-2026-87425 — An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before ","summary":"An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supplying an unauthorized Certificate Authority (CA) certificate to an unauthenticated management interface, the attacker can cause the system to trust unauthorized certificates, potentially enabling Man-in-the-Middle (MITM) attacks against outbound communications with managed switches and peer nodes.","source":"NVD","date":"2026-10-08T07:16:33.140Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87425","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87425"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87425"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87425"}],"epss":null},{"id":"CVE-2026-87424","title":"CVE-2026-87424 — A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 a","summary":"A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key.","source":"NVD","date":"2026-10-08T07:16:33.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87424","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87424"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87424"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87424"}],"epss":null},{"id":"CVE-2026-85490","title":"CVE-2026-85490 — When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoin","summary":"When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.","source":"NVD","date":"2026-10-08T07:16:32.860Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85490","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85490"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85490"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85490"}],"epss":null},{"id":"CVE-2026-85489","title":"CVE-2026-85489 — An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthe","summary":"An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and altering operational settings. This vulnerability affects all versions of Brocade ASCG before 3.5.0.","source":"NVD","date":"2026-10-08T07:16:32.727Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85489","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85489"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85489"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85489"}],"epss":null},{"id":"CVE-2026-85488","title":"CVE-2026-85488 — Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to e","summary":"Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer. Any local authenticated user with read access to the installation path can discover this credential and perform privilege escalation on affected Open Virtual Appliance (OVA) deployments, where default configuration settings remain in place.","source":"NVD","date":"2026-10-08T07:16:32.590Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85488","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85488"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85488"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85488"}],"epss":null},{"id":"CVE-2026-85487","title":"CVE-2026-85487 — A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0","summary":"A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.","source":"NVD","date":"2026-10-08T07:16:32.450Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85487","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85487"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85487"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85487"}],"epss":null},{"id":"CVE-2026-85486","title":"CVE-2026-85486 — Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. Wh","summary":"Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to validation. When an authenticated user submits a configuration form, the submitted text could immediately be processed. A malicious actor with basic access can supply crafted input to execute arbitrary code on the server and take control of the application.","source":"NVD","date":"2026-10-08T07:16:32.317Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85486","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85486"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85486"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85486"}],"epss":null},{"id":"CVE-2026-85423","title":"CVE-2026-85423 — A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0.","summary":"A vulnerability has been identified in the data collection service of Brocade ASCG versions before 3.5.0. An API endpoint within the data collector service fails to perform authentication or authorization checks on incoming requests. An attacker with network access to the service can instruct the application to establish SSH connections to arbitrary hosts and execute arbitrary system commands, effectively turning the appliance into an unauthenticated proxy or execution vector.","source":"NVD","date":"2026-10-08T07:16:32.177Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85423","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85423"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85423"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85423"}],"epss":null},{"id":"CVE-2026-85422","title":"CVE-2026-85422 — A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptogra","summary":"A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static cryptographic key hardcoded into the software binaries to secure sensitive data at rest and to protect inter-node communication protocols. An attacker who extracts this key can decrypt stored management credentials or craft forged administrative synchronization messages.","source":"NVD","date":"2026-10-08T07:16:32.033Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85422","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85422"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85422"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85422"}],"epss":null},{"id":"CVE-2026-85421","title":"CVE-2026-85421 — A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS se","summary":"A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states, and modify system configurations, leading to a complete compromise of the streaming service control plane.","source":"NVD","date":"2026-10-08T07:16:31.883Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85421","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85421"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85421"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85421"}],"epss":null},{"id":"CVE-2026-85097","title":"CVE-2026-85097 — The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions u","summary":"The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server.","source":"NVD","date":"2026-10-08T07:16:31.710Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85097","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-85097"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-85097"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85097"}],"epss":null},{"id":"CVE-2026-94275","title":"CVE-2026-94275 — The Track Orders for WooCommerce  WordPress plugin before 1.2.7 does not verify ownership of an order bef","summary":"The Track Orders for WooCommerce  WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.","source":"NVD","date":"2026-10-08T06:16:47.457Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94275","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94275"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94275"}],"epss":null},{"id":"CVE-2026-94258","title":"CVE-2026-94258 — The SMS Alert  WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to m","summary":"The SMS Alert  WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network.\nThis affects multisite only, and requires the SMS Alert  WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.","source":"NVD","date":"2026-10-08T06:16:47.143Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94258","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94258"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94258"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94258"}],"epss":null},{"id":"CVE-2026-94246","title":"CVE-2026-94246 — The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not verify that the wallet account ","summary":"The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount and a payout destination of their choosing, and to indefinitely prevent that user from submitting withdrawals of their own.","source":"NVD","date":"2026-10-08T06:16:46.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94246","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94246"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94246"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94246"}],"epss":null},{"id":"CVE-2026-94245","title":"CVE-2026-94245 — The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not verify that the user submitting","summary":"The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.","source":"NVD","date":"2026-10-08T06:16:46.533Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94245","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94245"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94245"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94245"}],"epss":null},{"id":"CVE-2026-94244","title":"CVE-2026-94244 — The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not perform any capability check, a","summary":"The Wallet System for WooCommerce  WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.","source":"NVD","date":"2026-10-08T06:16:46.197Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94244","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94244"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-94244"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94244"}],"epss":null},{"id":"CVE-2026-86828","title":"CVE-2026-86828 — The BackWPup  WordPress plugin before 5.7.7 does not properly restrict the destination path of files extr","summary":"The BackWPup  WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.","source":"NVD","date":"2026-10-08T06:16:45.287Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86828","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86828"],"cvss":{"score":6.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86828"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86828"}],"epss":null},{"id":"CVE-2026-86827","title":"CVE-2026-86827 — The BackWPup  WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup e","summary":"The BackWPup  WordPress plugin before 5.7.7 does not verify that a request to its cron-triggered backup execution handler actually originates from WordPress's internal scheduled-event dispatch, allowing unauthenticated attackers to force any existing backup job to run immediately, independent of its configured trigger type or schedule.","source":"NVD","date":"2026-10-08T06:16:44.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86827","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86827"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86827"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86827"}],"epss":null},{"id":"CVE-2026-86826","title":"CVE-2026-86826 — The BackWPup  WordPress plugin before 5.7.7 does not properly restrict web access to the working director","summary":"The BackWPup  WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.","source":"NVD","date":"2026-10-08T06:16:44.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86826","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-86826"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-86826"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86826"}],"epss":null},{"id":"CVE-2026-5769","title":"CVE-2026-5769 — A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captu","summary":"A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s).","source":"NVD","date":"2026-10-08T06:16:44.183Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5769","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-5769"],"cvss":{"score":5.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-5769"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5769"}],"epss":null},{"id":"CVE-2026-5049","title":"CVE-2026-5049 — A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.","summary":"A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.","source":"NVD","date":"2026-10-08T06:16:43.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5049","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-5049"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-5049"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5049"}],"epss":null},{"id":"CVE-2026-5048","title":"CVE-2026-5048 — In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have ","summary":"In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.","source":"NVD","date":"2026-10-08T06:16:43.273Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5048","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-5048"],"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-5048"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5048"}],"epss":null},{"id":"CVE-2026-5047","title":"CVE-2026-5047 — A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication to","summary":"A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and  authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.","source":"NVD","date":"2026-10-08T06:16:42.740Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5047","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-5047"],"cvss":{"score":8.2,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-5047"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5047"}],"epss":null},{"id":"CVE-2026-107459","title":"CVE-2026-107459 — The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote","summary":"The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.","source":"NVD","date":"2026-10-08T06:16:42.000Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107459","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107459"],"cvss":{"score":9.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"twcert@cert.org.tw"},"read":false,"kev":false,"recordIds":["CVE-2026-107459"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107459"}],"epss":null},{"id":"CVE-2026-105260","title":"CVE-2026-105260 — The Database Addon For WPForms ( wpforms entries )  WordPress plugin before 1.1.1 does not verify the CSR","summary":"The Database Addon For WPForms ( wpforms entries )  WordPress plugin before 1.1.1 does not verify the CSRF nonce when the field is omitted and performs no capability check of its own, allowing attackers to delete arbitrary stored form entries by tricking a logged-in administrator into loading a crafted page.","source":"NVD","date":"2026-10-08T06:16:41.130Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105260","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105260"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105260"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105260"}],"epss":null},{"id":"CVE-2026-105198","title":"CVE-2026-105198 — The Appointment Booking Plugin  WordPress plugin before 5.7.3 does not verify that the caller owns the or","summary":"The Appointment Booking Plugin  WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's name, contact details and order confirmation code by supplying a sequential order-item id.","source":"NVD","date":"2026-10-08T06:16:40.873Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105198","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105198"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105198"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105198"}],"epss":null},{"id":"CVE-2026-105197","title":"CVE-2026-105197 — The Appointment Booking Plugin  WordPress plugin before 5.6.5 does not verify that a backend staff user i","summary":"The Appointment Booking Plugin  WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on the site, including records belonging to other staff and outside their assigned scope.","source":"NVD","date":"2026-10-08T06:16:40.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105197","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105197"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105197"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105197"}],"epss":null},{"id":"CVE-2026-105196","title":"CVE-2026-105196 — The Appointment Booking Plugin  WordPress plugin before 5.6.9 does not enforce per-record authorization o","summary":"The Appointment Booking Plugin  WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile data and read other agents' bookings and associated customer details when the Abilities API feature is enabled.","source":"NVD","date":"2026-10-08T06:16:40.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105196","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105196"],"cvss":{"score":3.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105196"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105196"}],"epss":null},{"id":"CVE-2026-105195","title":"CVE-2026-105195 — The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-pr","summary":"The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.","source":"NVD","date":"2026-10-08T06:16:40.010Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105195","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105195"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105195"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105195"}],"epss":null},{"id":"CVE-2026-105194","title":"CVE-2026-105194 — The Easy Digital Downloads  WordPress plugin before 3.7.1 does not restrict a block's order data to the c","summary":"The Easy Digital Downloads  WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.","source":"NVD","date":"2026-10-08T06:16:39.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105194","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105194"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105194"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105194"}],"epss":null},{"id":"CVE-2026-105193","title":"CVE-2026-105193 — The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with su","summary":"The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes with sufficient entropy, deriving each from a low-entropy time-seeded value, which can allow unauthenticated attackers who are able to determine a booking's creation time to predict the hash and then read that booking's personal data or modify the booking in place.","source":"NVD","date":"2026-10-08T06:16:39.473Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105193","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105193"],"cvss":{"score":4.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-105193"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105193"}],"epss":null},{"id":"CVE-2026-104646","title":"CVE-2026-104646 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery","summary":"The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.","source":"NVD","date":"2026-10-08T06:16:39.147Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104646","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104646"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104646"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104646"}],"epss":null},{"id":"CVE-2026-104645","title":"CVE-2026-104645 — The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authoriz","summary":"The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the check entirely, allowing any authenticated user with contributor-level access or above to clone, modify and reorder galleries and images belonging to other users and to write Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 metadata onto arbitrary posts they do not own.","source":"NVD","date":"2026-10-08T06:16:38.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104645","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-104645"],"cvss":{"score":2.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-104645"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104645"}],"epss":null},{"id":"CVE-2026-103692","title":"CVE-2026-103692 — The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on","summary":"The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators.","source":"NVD","date":"2026-10-08T06:16:38.323Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103692","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103692"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103692"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103692"}],"epss":null},{"id":"CVE-2026-103646","title":"CVE-2026-103646 — The Ultimate Multisite  WordPress plugin before 2.17.0 does not require authentication before a logged-ou","summary":"The Ultimate Multisite  WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and its duplicate-account check normalizes that address differently from the lookup used to create the customer, so an unauthenticated attacker can log in as any existing user, including a Network Super Admin, whose email address they know.\nThis bypass is not addressed by the 2.15.1 fix for CVE-2026-75957 and remains exploitable in all versions up to and including 2.16.1, the releases that fix was expected to cover. Exploitation requires a checkout form configured without a password field (auto-generated password) and a target account that has no existing customer record in the Ultimate Multisite  WordPress plugin before 2.17.","source":"NVD","date":"2026-10-08T06:16:37.957Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103646","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103646"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103646"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103646"}],"epss":null},{"id":"CVE-2026-103309","title":"CVE-2026-103309 — The GPTranslate  WordPress plugin before 2.34.14 does not properly restrict who can store translations, a","summary":"The GPTranslate  WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.","source":"NVD","date":"2026-10-08T06:16:37.287Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103309","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-103309"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-103309"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103309"}],"epss":null},{"id":"https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html","title":"Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm","source":"The Hacker News","date":"2026-10-08T05:46:20.000Z","summary":"The npm package known as \"tensorlake,\" a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.  144 \"contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,\" Socket said","url":"https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html","topic":"Cyber news","read":false,"source_type":"independent_security_news","kev":false,"cvss":null,"aliases":[],"recordIds":["https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html"],"sources":["The Hacker News"],"topics":["Cyber news"],"affected":[],"references":[{"source":"The Hacker News","url":"https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html"}],"epss":null},{"id":"CVE-2026-94587","title":"CVE-2026-94587 — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration do","summary":"A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can overflow stack buffers causing a crash of the weblinker daemon.","source":"NVD","date":"2026-10-08T05:17:06.890Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94587","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94587"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94587"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94587"}],"epss":null},{"id":"CVE-2026-94586","title":"CVE-2026-94586 — A command injection vulnerability exists in the WebTools administrative interface handling configuration ","summary":"A command injection vulnerability exists in the WebTools administrative interface handling configuration download or file transfer operations of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with permissions to perform configuration downloads using remote server profiles can supply malicious parameter strings to execute arbitrary shell commands on the switch with root privileges","source":"NVD","date":"2026-10-08T05:17:06.660Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94586","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94586"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94586"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94586"}],"epss":null},{"id":"CVE-2026-94585","title":"CVE-2026-94585 — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versio","summary":"An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions before 9.2.2d running on the MXG610 platform. An unauthenticated, network-adjacent attacker can exploit an unauthenticated endpoint within the Single Sign-On (SSO) workflow to gain administrative access to the device management interface.","source":"NVD","date":"2026-10-08T05:17:06.523Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94585","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94585"],"cvss":{"score":7.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94585"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94585"}],"epss":null},{"id":"CVE-2026-94581","title":"CVE-2026-94581 — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS ve","summary":"An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 allows an authenticated, high-privileged remote attacker to execute arbitrary system commands with root permissions. An attacker with administrative privileges to configure SSH known host settings can supply specially crafted parameter values containing shell metacharacters to trigger command execution on the host system.","source":"NVD","date":"2026-10-08T05:17:06.393Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94581","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94581"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94581"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94581"}],"epss":null},{"id":"CVE-2026-94579","title":"CVE-2026-94579 — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup","summary":"An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service whose username or profile identifier contains shell metacharacters can trigger arbitrary command execution with root privileges when their remote SSH session closes.","source":"NVD","date":"2026-10-08T05:17:06.247Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94579","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94579"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94579"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94579"}],"epss":null},{"id":"CVE-2026-94577","title":"CVE-2026-94577 — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization ha","summary":"A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user or local process that can manipulate the process execution environment can bypass Role-Based Access Control (RBAC) validation checks. Successful exploitation allows an attacker to elevate privileges to root","source":"NVD","date":"2026-10-08T05:17:06.113Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94577","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94577"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94577"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94577"}],"epss":null},{"id":"CVE-2026-94576","title":"CVE-2026-94576 — An authentication logic and privilege escalation vulnerability exists in the account management interface","summary":"An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticated user can bypass authorization restrictions intended to prevent modifying another account's access privileges. Exploitation allows a lower-privileged user to assign administrative roles to a target account, leading to localized privilege escalation.","source":"NVD","date":"2026-10-08T05:17:05.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94576","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94576"],"cvss":{"score":5.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94576"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94576"}],"epss":null},{"id":"CVE-2026-87677","title":"CVE-2026-87677 — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS ver","summary":"An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When an administrator initiates an account deletion, the system invokes an internal maintenance routine to clean up cryptographic keys associated with the target account. Malformed account names previously accepted by Fabric OS can cause the execution of embedded shell metacharacters, triggering command injection.","source":"NVD","date":"2026-10-08T05:17:05.833Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87677","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87677"],"cvss":{"score":5.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87677"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87677"}],"epss":null},{"id":"CVE-2026-87664","title":"CVE-2026-87664 — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions","summary":"A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication (IPC) storage callbacks, the service accepts and registers session structures including administrative role permissions, user identifiers, and authorization flags—without verifying the identity or authenticity of the sending process. An attacker can obtain elevated administrative privileges on the web management interface without legitimate authentication.","source":"NVD","date":"2026-10-08T05:17:05.697Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87664","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87664"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87664"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87664"}],"epss":null},{"id":"CVE-2026-87663","title":"CVE-2026-87663 — An authentication bypass and command injection vulnerability exists in the inter-switch remote execution ","summary":"An authentication bypass and command injection vulnerability exists in the inter-switch remote execution service of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing remote command execution IPC frames across the fabric, the receiving switch processes these commands at an elevated processing level without proper verification of transmitted parameters. This allows an attacker on a single fabric-connected switch to escalate privileges and execute arbitrary root commands locally or across other managed fabric members where remote execution functionality is enabled.","source":"NVD","date":"2026-10-08T05:17:05.567Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87663","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87663"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87663"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87663"}],"epss":null},{"id":"CVE-2026-87662","title":"CVE-2026-87662 — Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols","summary":"Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control characters and shell metacharacters in fields like the host or file path are not stripped or sanitized, an attacker can execute arbitrary shell commands with the firmware management daemon's elevated privileges.","source":"NVD","date":"2026-10-08T05:17:05.433Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87662","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87662"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87662"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87662"}],"epss":null},{"id":"CVE-2026-87661","title":"CVE-2026-87661 — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuratio","summary":"Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration file data during service setup or re-initialization. An attacker capable of corrupting the configuration structure will prevent the web management service from starting or recovering during service bring-up, leading to a persistent Denial of Service (DoS) of the administrative web interface.","source":"NVD","date":"2026-10-08T05:17:05.297Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87661","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87661"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87661"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87661"}],"epss":null},{"id":"CVE-2026-17609","title":"CVE-2026-17609 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Dele","summary":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function. This is due to insufficient validation of attacker-controlled JSON field declarations against the actual form schema, combined with a non-effective ABSPATH guard that dirname() trivially bypasses by stripping the trailing slash. This makes it possible for unauthenticated attackers to recursively delete arbitrary directories on the server, including the WordPress root directory. Exploitation requires that an administrator has enabled the 'Delete files from server after form submissions' setting, though this is a documented and commonly-enabled feature.","source":"NVD","date":"2026-10-08T05:17:04.793Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17609","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-17609"],"cvss":{"score":9.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-17609"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17609"}],"epss":null},{"id":"CVE-2026-17196","title":"CVE-2026-17196 — The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type U","summary":"The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function. This is due to missing file type validation in the upload_files function, which reads and applies an attacker-controlled extensions string from _super_elements post meta verbatim as the allowed MIME type map. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. The attack requires a preceding step: poisoning the _super_elements post meta via the super_save_form AJAX handler, which lacks a capability and nonce check but requires the attacker to be authenticated as at minimum a Subscriber-level user; the subsequent file upload via supe","source":"NVD","date":"2026-10-08T05:17:04.657Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17196","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-17196"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-17196"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17196"}],"epss":null},{"id":"CVE-2026-107450","title":"CVE-2026-107450 — In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mu","summary":"In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only on the shared AccessSmartList permission and resolve the target list at Reader access (lacking a creator check). Any authenticated user with that permission can overwrite, delete, or take over another user's smart list. (updateSmartList sets creatorId to the caller identity, and can set visibility to PRIVATE, locking out the original owner.) NOTE: this is unrelated to the graphql crate on crates.io.","source":"NVD","date":"2026-10-08T05:17:04.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107450","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107450"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107450"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107450"}],"epss":null},{"id":"CVE-2026-107449","title":"CVE-2026-107449 — linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemContr","summary":"linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, and thus an unauthenticated attacker can force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.","source":"NVD","date":"2026-10-08T05:17:04.297Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107449","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107449"],"cvss":{"score":3.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107449"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107449"}],"epss":null},{"id":"CVE-2023-5649","title":"CVE-2023-5649 — An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.","summary":"An Improper Input Validation vulnerability for the registered case credentials in Brocade ASCG before v3.0 could allow a local authenticated user to provide invalid inputs like special characters leading to a Denial of Service (DoS) when collecting “supportsave” from a Brocade Switch.","source":"NVD","date":"2026-10-08T05:17:03.970Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5649","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-5649"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2023-5649"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5649"}],"epss":null},{"id":"CVE-2023-5648","title":"CVE-2023-5648 — In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various B","summary":"In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more.","source":"NVD","date":"2026-10-08T05:17:03.747Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5648","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2023-5648"],"cvss":{"score":6.5,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2023-5648"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5648"}],"epss":null},{"id":"CVE-2026-94584","title":"CVE-2026-94584 — A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS","summary":"A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP addresses and switch context numbers. This leads to inaccurate audit records and potential access control bypasses where AAA evaluation or Calling-Station-ID ACL policies rely on client IP attributes.","source":"NVD","date":"2026-10-08T04:18:00.600Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94584","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94584"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94584"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94584"}],"epss":null},{"id":"CVE-2026-94580","title":"CVE-2026-94580 — An arbitrary file and directory deletion vulnerability exists in the REST API management interface handli","summary":"An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary files or directories on the switch's local root filesystem, bypassing intended USB mount point boundaries.","source":"NVD","date":"2026-10-08T04:18:00.347Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94580","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94580"],"cvss":{"score":5.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94580"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94580"}],"epss":null},{"id":"CVE-2026-94575","title":"CVE-2026-94575 — A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an auth","summary":"A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bypass inner Role-Based Access Control (RBAC) checks under specific environmental conditions. Successful exploitation lowers the system authorization mode for the active session context, allowing access to restricted configuration settings intended exclusively for administrative roles.","source":"NVD","date":"2026-10-08T04:18:00.023Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94575","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94575"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94575"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94575"}],"epss":null},{"id":"CVE-2026-87688","title":"CVE-2026-87688 — An input validation vulnerability exists in the security certificate management component of the Brocade ","summary":"An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution in external system routines. An authenticated attacker with privileges to perform certificate deletion requests can leverage this flaw to execute arbitrary system commands with the privileges of the underlying management daemon. This vulnerability affects Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.","source":"NVD","date":"2026-10-08T04:17:56.623Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87688","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87688"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87688"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87688"}],"epss":null},{"id":"CVE-2026-87687","title":"CVE-2026-87687 — An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d an","summary":"An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user with restricted privileges in one Virtual Fabric can exploit this issue by submitting a specially crafted request containing an arbitrary fabric identifier. This allows the user to perform unauthorized cross-fabric operations and view configuration details within tenants/Virtual Fabrics to which they have not been granted access.","source":"NVD","date":"2026-10-08T04:17:56.360Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87687","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87687"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87687"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87687"}],"epss":null},{"id":"CVE-2026-87685","title":"CVE-2026-87685 — An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabri","summary":"An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file path parameter. An authenticated administrative user can exploit this issue by submitting a specially crafted status file parameter, causing the underlying process to move an arbitrary system file to a predictable, world-readable temporary directory. This can lead to persistent Denial of Service (DoS), critical system file destruction, host compromise, or sensitive data leakage.","source":"NVD","date":"2026-10-08T04:17:56.097Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87685","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87685"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87685"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87685"}],"epss":null},{"id":"CVE-2026-87675","title":"CVE-2026-87675 — An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric ","summary":"An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.","source":"NVD","date":"2026-10-08T04:17:55.843Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87675","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87675"],"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87675"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87675"}],"epss":null},{"id":"CVE-2026-87674","title":"CVE-2026-87674 — A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versi","summary":"A local privilege escalation vulnerability exists in the system logging daemon of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Insufficient access controls on internal inter-process communication (IPC) channels allow an unprivileged local user to submit malformed logging configurations. Due to improper input sanitization during configuration file generation, an attacker can inject arbitrary directives that execute with elevated privileges when the logging service reloads, leading to local privilege escalation.","source":"NVD","date":"2026-10-08T04:17:53.370Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87674","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87674"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87674"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87674"}],"epss":null},{"id":"CVE-2026-87673","title":"CVE-2026-87673 — An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade ","summary":"An OS command injection vulnerability exists in maintenance command-line diagnostic utilities on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. The binary fails to sanitize user-supplied input options when invoking underlying system commands through a shell interpreter. A privileged user with maintenance account access can exploit this issue by supplying crafted parameters, which results in arbitrary OS command execution with root privileges.","source":"NVD","date":"2026-10-08T04:17:53.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87673","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87673"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87673"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87673"}],"epss":null},{"id":"CVE-2026-87667","title":"CVE-2026-87667 — An argument injection vulnerability exists in the configuration management command-line utility of Brocad","summary":"An argument injection vulnerability exists in the configuration management command-line utility of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When executing configuration viewing commands with search pattern filters, the utility fails to sanitize user-supplied search string options before passing them to internal search commands. An authenticated user with low-privilege administrative access can exploit this vulnerability to read arbitrary files on the local operating system, including sensitive configuration files, system password hashes and system secrets.","source":"NVD","date":"2026-10-08T04:17:52.843Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87667","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87667"],"cvss":{"score":8.4,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87667"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87667"}],"epss":null},{"id":"CVE-2026-87666","title":"CVE-2026-87666 — An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric ","summary":"An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values before processing them in underlying shell execution routines. An authenticated user with low-privilege administrative access can exploit this vulnerability by submitting a crafted timezone string containing shell metacharacters. Successful exploitation allows the attacker to escape the restricted management environment and execute arbitrary shell commands with elevated privileges.","source":"NVD","date":"2026-10-08T04:17:52.553Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87666","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87666"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87666"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87666"}],"epss":null},{"id":"CVE-2026-87660","title":"CVE-2026-87660 — An improper file permission and missing authorization vulnerability exists in the diagnostic kernel modul","summary":"An improper file permission and missing authorization vulnerability exists in the diagnostic kernel module subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An unprivileged local user can invoke privileged hardware tests, force system error conditions, reset hardware blades, or disrupt storage fabric operations.","source":"NVD","date":"2026-10-08T04:17:52.107Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87660","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87660"],"cvss":{"score":7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87660"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87660"}],"epss":null},{"id":"CVE-2026-107448","title":"CVE-2026-107448 — Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x b","summary":"Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds) passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or domain. A hypothetical attacker able to control the carousel content delivered to clients can cause arbitrary registered URI-scheme handlers to be invoked on client hosts with no user interaction. For example, one might expect that the carousel content only has https: URIs, not ms-calculator: URIs.","source":"NVD","date":"2026-10-08T04:17:19.640Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107448","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107448"],"cvss":{"score":3.4,"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107448"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107448"}],"epss":null},{"id":"CVE-2026-107446","title":"CVE-2026-107446 — containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and result","summary":"containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for index_bytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers.","source":"NVD","date":"2026-10-08T04:17:19.410Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107446","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107446"],"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107446"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107446"}],"epss":null},{"id":"CVE-2026-107445","title":"CVE-2026-107445 — A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authoriza","summary":"A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository information belonging to another organization. The same unscoped lookup is used by the mirror action, which may allow creating a repository in a product the user can edit that is configured with another organization's flatpak remote URL and stored remote credentials.","source":"NVD","date":"2026-10-08T04:17:19.220Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107445","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107445"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107445"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107445"}],"epss":null},{"id":"CVE-2026-107444","title":"CVE-2026-107444 — A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization","summary":"A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with Docker tags belonging to another organization by supplying the tag identifier. This can result in unauthorized disclosure of repository configuration information across organization boundaries.","source":"NVD","date":"2026-10-08T04:17:14.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107444","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107444"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"secalert@redhat.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107444"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107444"}],"epss":null},{"id":"CVE-2026-94583","title":"CVE-2026-94583 — A race condition vulnerability exists in the request processing logic of the REST management interface on","summary":"A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.","source":"NVD","date":"2026-10-08T03:16:38.120Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94583","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94583"],"cvss":{"score":2.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94583"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94583"}],"epss":null},{"id":"CVE-2026-94582","title":"CVE-2026-94582 — A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines us","summary":"A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While this code path is part of internal diagnostic functionality and is not directly accessible via standard user interfaces or CLI management commands, an input processing flaw allows incoming or internally routed diagnostic state payloads to exceed allocated memory boundaries. An attacker that is able to chain or link other vulnerabilities to exploit this internal diagnostic could cause a heap- or stack-based memory overrun, resulting in a daemon crash (Denial of Service) or potential arbitrary code execution within the context of the routing daemon.","source":"NVD","date":"2026-10-08T03:16:37.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94582","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94582"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94582"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94582"}],"epss":null},{"id":"CVE-2026-94578","title":"CVE-2026-94578 — Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authent","summary":"Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.","source":"NVD","date":"2026-10-08T03:16:37.840Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94578","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94578"],"cvss":{"score":7.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94578"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94578"}],"epss":null},{"id":"CVE-2026-92862","title":"CVE-2026-92862 — The Android application \"Ticket Ryutsu Center\" improperly handles custom URL schemes, allowing a maliciou","summary":"The Android application \"Ticket Ryutsu Center\" improperly handles custom URL schemes, allowing a malicious application to cause access to an arbitrary website via a crafted Intent.","source":"NVD","date":"2026-10-08T03:16:37.683Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92862","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92862"],"cvss":{"score":4.6,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"vultures@jpcert.or.jp"},"read":false,"kev":false,"recordIds":["CVE-2026-92862"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92862"}],"epss":null},{"id":"CVE-2026-92861","title":"CVE-2026-92861 — The Android application \"Ticket Ryutsu Center\" contains hard-coded credentials, which may allow an attack","summary":"The Android application \"Ticket Ryutsu Center\" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application.","source":"NVD","date":"2026-10-08T03:16:37.530Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92861","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-92861"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"vultures@jpcert.or.jp"},"read":false,"kev":false,"recordIds":["CVE-2026-92861"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92861"}],"epss":null},{"id":"CVE-2026-87686","title":"CVE-2026-87686 — An authentication and access control bypass vulnerability exists in the web server management interface o","summary":"An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before 10.0.1. The web dispatcher routine evaluates internal management VLAN trust decisions using the client-supplied HTTP host header instead of the actual socket transport layer source IP address. Successful exploitation allows the attacker to bypass IP-filtering access control lists (ACLs) and obtain sensitive device metadata (such as model, serial number, hardware revision, and firmware version) without authentication.","source":"NVD","date":"2026-10-08T03:16:37.390Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87686","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87686"],"cvss":{"score":5.3,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87686"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87686"}],"epss":null},{"id":"CVE-2026-87684","title":"CVE-2026-87684 — A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric ","summary":"A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When processing an incoming SNMPv3 packet, an internal statistics gathering handler copies user-supplied context name data into a fixed-size buffer without properly validating the length of the string. A remote, unauthenticated attacker (under default configuration) can exploit this vulnerability by sending a specially crafted SNMPv3 packet, leading to memory corruption, daemon crash (Denial of Service), or potential arbitrary code execution.","source":"NVD","date":"2026-10-08T03:16:37.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87684","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87684"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87684"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87684"}],"epss":null},{"id":"CVE-2026-87678","title":"CVE-2026-87678 — An input validation and output encoding vulnerability exists in the web management interface of Brocade F","summary":"An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. When configuring Federated Authentication (FA), the system fails to sanitize the Identity Provider (IdP) issuer parameter. An authenticated administrator—or an attacker capable of supplying crafted FA configuration files during an import routine—can inject arbitrary web server directives. This can lead to service denial by preventing the web management daemon from starting, or potentially alter web server security controls.","source":"NVD","date":"2026-10-08T03:16:37.093Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87678","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87678"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87678"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87678"}],"epss":null},{"id":"CVE-2026-87676","title":"CVE-2026-87676 — A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS","summary":"A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsing uploaded X.509 PEM certificates for management display, the system improperly validates the length of the Authority Key Identifier (AKI) extension before copying string tokens into an internal memory buffer. An authenticated user with administrative privileges to import custom certificates can supply a certificate containing an intentionally oversized AKI extension. When the system processes or renders the certificate attributes, this can trigger a stack memory corruption leading to a denial-of-service (DoS) condition by crashing the management daemon.","source":"NVD","date":"2026-10-08T03:16:36.950Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87676","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87676"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87676"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87676"}],"epss":null},{"id":"CVE-2026-87672","title":"CVE-2026-87672 — An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Broc","summary":"An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support bundle, such as support personnel or users with access to file shares where support bundles are stored, can extract these cleartext proxy credentials.","source":"NVD","date":"2026-10-08T03:16:36.810Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87672","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87672"],"cvss":{"score":6.8,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87672"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87672"}],"epss":null},{"id":"CVE-2026-87671","title":"CVE-2026-87671 — An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versi","summary":"An out-of-bounds memory read vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. Unauthenticated HTTP endpoints process specific URL query parameters without validating array index boundaries or performing numerical range checks. An unauthenticated remote attacker can exploit this issue by sending a single, crafted HTTP request containing extreme numerical values in the query string. This causes an invalid memory dereference, resulting in a crash of the web management process (Denial of Service) and potential temporary management-plane disruption.","source":"NVD","date":"2026-10-08T03:16:36.650Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87671","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87671"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87671"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87671"}],"epss":null},{"id":"CVE-2026-87670","title":"CVE-2026-87670 — An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gate","summary":"An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers to gain unauthorized access to internal management endpoints. This allows low-privilege users to view sensitive chassis metadata, hardware memory patrolling state, and firmware integrity audit logs.","source":"NVD","date":"2026-10-08T03:16:36.403Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87670","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87670"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87670"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87670"}],"epss":null},{"id":"CVE-2026-87669","title":"CVE-2026-87669 — A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected ","summary":"A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges.","source":"NVD","date":"2026-10-08T03:16:36.237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87669","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87669"],"cvss":{"score":5.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87669"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87669"}],"epss":null},{"id":"CVE-2026-87668","title":"CVE-2026-87668 — A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric ","summary":"A stack-based buffer overflow vulnerability exists in the diagnostic execution utility of Brocade Fabric OS versions before 10.0.1. When processing command arguments for diagnostic operations, the utility tokenizes user-supplied input into an internal argument array without enforcing boundary checks on the maximum array capacity. An authenticated user with administrative access can exploit this vulnerability by supplying a crafted diagnostic command string containing an excessive number of tokenized arguments. This leads to a memory overwrite resulting in a denial of service (process crash).","source":"NVD","date":"2026-10-08T03:16:36.100Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87668","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87668"],"cvss":{"score":6.9,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87668"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87668"}],"epss":null},{"id":"CVE-2026-87665","title":"CVE-2026-87665 — A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler ","summary":"A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requests on extension switches or blades running IPsec-enabled Fibre Channel over IP (FCIP) circuits. An unauthenticated remote attacker can exploit this vulnerability by sending a single, specifically crafted UDP packet (Port 500) containing an oversized Nonce payload. Successful exploitation results in a denial of service (data-plane process crash)","source":"NVD","date":"2026-10-08T03:16:35.960Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87665","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87665"],"cvss":{"score":6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87665"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87665"}],"epss":null},{"id":"CVE-2026-87659","title":"CVE-2026-87659 — A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric ","summary":"A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.","source":"NVD","date":"2026-10-08T03:16:35.820Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87659","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87659"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87659"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87659"}],"epss":null},{"id":"CVE-2017-20283","title":"CVE-2017-20283 — NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() imple","summary":"NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of the application-supplied receive buffer length may allow a crafted UDP packet to overflow the destination buffer, resulting in memory corruption, or denial of service.","source":"NVD","date":"2026-10-08T03:16:32.343Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20283","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2017-20283"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2017-20283"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20283"}],"epss":null},{"id":"CVE-2026-87726","title":"CVE-2026-87726 — Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an","summary":"Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.","source":"NVD","date":"2026-10-08T02:16:54.713Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87726","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87726"],"cvss":{"score":3.9,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-87726"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87726"}],"epss":null},{"id":"CVE-2026-87683","title":"CVE-2026-87683 — Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocad","summary":"Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.","source":"NVD","date":"2026-10-08T02:16:54.563Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87683","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87683"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87683"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87683"}],"epss":null},{"id":"CVE-2026-87682","title":"CVE-2026-87682 — Multiple OS Command Injection vulnerabilities exist in the management interface and session processing ro","summary":"Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.","source":"NVD","date":"2026-10-08T02:16:54.420Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87682","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87682"],"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87682"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87682"}],"epss":null},{"id":"CVE-2026-82627","title":"CVE-2026-82627 — The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included","summary":"The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo,  MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.","source":"NVD","date":"2026-10-08T02:16:54.263Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82627","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-82627"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-82627"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82627"}],"epss":null},{"id":"CVE-2026-102488","title":"CVE-2026-102488 — In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowi","summary":"In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted to them.","source":"NVD","date":"2026-10-08T02:16:53.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102488","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-102488"],"cvss":{"score":8.7,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security@octopus.com"},"read":false,"kev":false,"recordIds":["CVE-2026-102488"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102488"}],"epss":null},{"id":"CVE-2026-87681","title":"CVE-2026-87681 — An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine o","summary":"An Access Control Bypass vulnerability exists in the Role-Based Access Control (RBAC) validation engine of Brocade Fabric OS versions before 10.0.1. When processing certain management protocol operations, the RBAC engine incorrectly categorizes non-standard action opcodes during permission checks. This allows authenticated users with read-only management privileges to bypass access controls and execute restricted administrative operations.","source":"NVD","date":"2026-10-08T01:16:32.620Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87681","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87681"],"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87681"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87681"}],"epss":null},{"id":"CVE-2026-87680","title":"CVE-2026-87680 — A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions befo","summary":"A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.","source":"NVD","date":"2026-10-08T01:16:32.480Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87680","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87680"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87680"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87680"}],"epss":null},{"id":"CVE-2026-87679","title":"CVE-2026-87679 — When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application p","summary":"When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution.","source":"NVD","date":"2026-10-08T01:16:32.313Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87679","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-87679"],"cvss":{"score":8.5,"version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"sirt@brocade.com"},"read":false,"kev":false,"recordIds":["CVE-2026-87679"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87679"}],"epss":null},{"id":"CVE-2024-8122","title":"CVE-2024-8122 — The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in","summary":"The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the OTP.\n\nThe absence of automatic expiration for OTPs grants attackers an unlimited timeframe to attempt guessing the correct code. A successful brute force attack can lead to an MFA bypass, resulting in the unauthorized takeover of a user's account and compromising the security and privacy of both the individual and the system.","source":"NVD","date":"2026-10-08T01:16:32.037Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8122","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2024-8122"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"},"read":false,"kev":false,"recordIds":["CVE-2024-8122"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8122"}],"epss":null},{"id":"CVE-2026-94154","title":"CVE-2026-94154 — The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parame","summary":"The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.","source":"NVD","date":"2026-10-08T00:16:35.333Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94154","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-94154"],"cvss":{"score":6.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-94154"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94154"}],"epss":null},{"id":"CVE-2026-17538","title":"CVE-2026-17538 — The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct O","summary":"The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate before merging POSTed customer data into an existing LatePoint customer, without any ownership checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the personal information (first name, last name, email, phone, notes) of arbitrary LatePoint customers, and, when the contact_merge setting is 'phone', to overwrite the victim's email address and take over the account via a password reset.","source":"NVD","date":"2026-10-08T00:16:35.153Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17538","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-17538"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"security@wordfence.com"},"read":false,"kev":false,"recordIds":["CVE-2026-17538"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17538"}],"epss":null},{"id":"CVE-2026-107315","title":"CVE-2026-107315 — pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its","summary":"pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a connection with GSS encryption. The padding happens when an application declares a length larger than the data it supplies, through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The driver accepts these calls without an error. An attacker who can make the applicati","source":"NVD","date":"2026-10-08T00:16:33.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107315","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107315"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},"read":false,"kev":false,"recordIds":["CVE-2026-107315"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107315"}],"epss":null},{"id":"CVE-2015-5477","title":"ISC BIND Data Processing Errors Vulnerability","source":"CISA KEV","date":"2026-10-08","summary":"ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. CISA action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477","topic":"Exploited vulnerabilities","read":false,"aliases":["CVE-2015-5477"],"affected":[{"vendor":"ISC","product":"BIND"}],"kev":true,"cvss":null,"recordIds":["CVE-2015-5477"],"sources":["CISA KEV"],"topics":["Exploited vulnerabilities"],"references":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5477"}],"epss":{"score":0.99409,"date":"2026-10-12","percentile":0.99941}},{"id":"CVE-2016-3081","title":"Apache Struts Command Injection Vulnerability","source":"CISA KEV","date":"2026-10-08","summary":"Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled. CISA action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081","topic":"Exploited vulnerabilities","read":false,"aliases":["CVE-2016-3081"],"affected":[{"vendor":"Apache","product":"Struts"}],"kev":true,"cvss":null,"recordIds":["CVE-2016-3081"],"sources":["CISA KEV"],"topics":["Exploited vulnerabilities"],"references":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3081"}],"epss":{"score":0.96052,"date":"2026-10-12","percentile":0.99877}},{"id":"CVE-2023-22894","title":"Strapi Cleartext Storage of Sensitive Information Vulnerability","source":"CISA KEV","date":"2026-10-08","summary":"Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter.  The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS).","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894","topic":"Exploited vulnerabilities","read":false,"aliases":["CVE-2023-22894"],"affected":[{"vendor":"Strapi","product":"Strapi"}],"kev":true,"cvss":null,"recordIds":["CVE-2023-22894"],"sources":["CISA KEV"],"topics":["Exploited vulnerabilities"],"references":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-22894"}],"epss":{"score":0.03609,"date":"2026-10-12","percentile":0.89211}},{"id":"CVE-2021-3199","title":"ONLYOFFICE Docs Server Path Traversal Vulnerability","source":"CISA KEV","date":"2026-10-08","summary":"ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /..  sequence in an image upload parameter and could allow for remote code execution.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199","topic":"Exploited vulnerabilities","read":false,"aliases":["CVE-2021-3199"],"affected":[{"vendor":"ONLYOFFICE","product":"Docs"}],"kev":true,"cvss":null,"recordIds":["CVE-2021-3199"],"sources":["CISA KEV"],"topics":["Exploited vulnerabilities"],"references":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-3199"}],"epss":{"score":0.19352,"date":"2026-10-12","percentile":0.97297}},{"id":"CVE-2015-3306","title":"ProFTPD Improper Access Control Vulnerability","source":"CISA KEV","date":"2026-10-08","summary":"ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. CISA action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306","topic":"Exploited vulnerabilities","read":false,"aliases":["CVE-2015-3306"],"affected":[{"vendor":"ProFTPD","product":"ProFTPD"}],"kev":true,"cvss":null,"recordIds":["CVE-2015-3306"],"sources":["CISA KEV"],"topics":["Exploited vulnerabilities"],"references":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-3306"}],"epss":{"score":0.99497,"date":"2026-10-12","percentile":0.99945}},{"id":"CVE-2026-97664","title":"CVE-2026-97664 — Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","summary":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","source":"NVD","date":"2026-10-07T23:17:01.520Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97664","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-97664"],"read":false,"cvss":null,"kev":false,"recordIds":["CVE-2026-97664"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97664"}],"epss":null},{"id":"CVE-2026-89322","title":"CVE-2026-89322 — Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resou","summary":"Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.","source":"NVD","date":"2026-10-07T23:17:01.197Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89322","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-89322"],"cvss":{"score":7.2,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","source":"security@hashicorp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-89322"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89322"}],"epss":null},{"id":"CVE-2026-107314","title":"CVE-2026-107314 — pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requ","summary":"pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the pro","source":"NVD","date":"2026-10-07T23:17:00.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107314","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107314"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},"read":false,"kev":false,"recordIds":["CVE-2026-107314"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107314"}],"epss":null},{"id":"CVE-2026-107284","title":"CVE-2026-107284 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, WebSocketHandler.upgrade aborts a handshake whose Sec-WebSocket-Accept value is missing or invalid but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.","source":"NVD","date":"2026-10-07T22:17:04.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107284","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107284"],"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107284"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107284"}],"epss":null},{"id":"CVE-2026-107281","title":"CVE-2026-107281 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.","source":"NVD","date":"2026-10-07T22:17:03.980Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107281","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107281"],"cvss":{"score":7.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107281"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107281"}],"epss":null},{"id":"CVE-2026-107279","title":"CVE-2026-107279 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.","source":"NVD","date":"2026-10-07T22:17:03.657Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107279","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107279"],"cvss":{"score":8.8,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107279"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107279"}],"epss":null},{"id":"CVE-2026-107232","title":"CVE-2026-107232 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authorization credentials onto the still-plaintext proxy connection. Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. This issue is fixed in versions 3.0.12 and 2.16.1.","source":"NVD","date":"2026-10-07T22:17:03.497Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107232","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107232"],"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107232"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107232"}],"epss":null},{"id":"CVE-2026-105820","title":"CVE-2026-105820 — Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal construct","summary":"Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.","source":"NVD","date":"2026-10-07T22:17:02.990Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105820","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105820"],"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"security@hashicorp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105820"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105820"}],"epss":null},{"id":"CVE-2026-105818","title":"CVE-2026-105818 — Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do no","summary":"Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling impersonation toward systems that trust certificates issued by the affected Vault PKI mount. This vulnerability (CVE-2026-105818) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.","source":"NVD","date":"2026-10-07T22:17:02.843Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105818","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105818"],"cvss":{"score":5.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","source":"security@hashicorp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105818"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105818"}],"epss":null},{"id":"CVE-2026-105816","title":"CVE-2026-105816 — Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binar","summary":"Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within the configured plugin directory. When Vault uses Shamir seals and has an external plugin directory configured, a privileged operator able to restore an Integrated Storage (Raft) snapshot may be able to execute arbitrary code on the Vault host. This vulnerability (CVE-2026-105816) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.","source":"NVD","date":"2026-10-07T22:17:02.673Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105816","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-105816"],"cvss":{"score":8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"security@hashicorp.com"},"read":false,"kev":false,"recordIds":["CVE-2026-105816"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105816"}],"epss":null},{"id":"CVE-2026-76286","title":"CVE-2026-76286 — In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authenticatio","summary":"In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authentication token of a user who runs a custom Application Programming Interface (API) tool to the URL configured for that tool. If another user controls that URL, they could capture the token and use it to access data and perform actions as the user who ran the tool. Successful exploitation requires a user who holds a role that contains the mcp_tool_execute capability to run a custom API tool configured by another user. For more information see Configure the Splunk MCP Server (https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/configure-the-splunk-mcp-server) and Managing custom tools in Splunk MCP Server (https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/1.2/managing-custom-tools-in-splunk-","source":"NVD","date":"2026-10-07T21:17:20.387Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76286","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76286"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76286"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76286"}],"epss":null},{"id":"CVE-2026-76285","title":"CVE-2026-76285 — Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities i","summary":"Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.","source":"NVD","date":"2026-10-07T21:17:20.250Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76285","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76285"],"cvss":null,"read":false,"kev":false,"recordIds":["CVE-2026-76285"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76285"}],"epss":null},{"id":"CVE-2026-76284","title":"CVE-2026-76284 — Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterp","summary":"Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.","source":"NVD","date":"2026-10-07T21:17:20.117Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76284","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76284"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-76284"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76284"}],"epss":null},{"id":"CVE-2026-76283","title":"CVE-2026-76283 — Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk E","summary":"Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.","source":"NVD","date":"2026-10-07T21:17:19.987Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76283","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76283"],"cvss":{"score":7.6,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-76283"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76283"}],"epss":null},{"id":"CVE-2026-76282","title":"CVE-2026-76282 — Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vuln","summary":"Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.","source":"NVD","date":"2026-10-07T21:17:19.700Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76282","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76282"],"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-76282"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76282"}],"epss":null},{"id":"CVE-2026-76281","title":"CVE-2026-76281 — Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterp","summary":"Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (CWE), with one Common Vulnerabilities and Exposures (CVE) identifier assigned to each group. See Details for more information.","source":"NVD","date":"2026-10-07T21:17:19.483Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76281","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76281"],"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},"read":false,"kev":false,"recordIds":["CVE-2026-76281"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76281"}],"epss":null},{"id":"CVE-2026-76280","title":"CVE-2026-76280 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versio","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an authenticated user who does not hold the \"admin\" or \"sc_admin\" Splunk roles could modify Splunk Secure Gateway alert and mobile-device recipient data in App Key Value Store (KV Store) collections that later alert and subscription workflows use. The vulnerability is possible because the affected collections allow unrestricted write access instead of limiting writes to authorized Splunk Secure Gateway workflows. For more information see About the app key value store (https://help.splunk.com/en/splunk-enterprise/administer/admin-manual/10.4/administer-the-app-key-value-store/about-the-app-key-value-store), KV store endpoint descriptions (https://help.splunk.com/en/splunk-enterprise/leverage-rest-ap","source":"NVD","date":"2026-10-07T21:17:19.327Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76280","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76280"],"cvss":{"score":6.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76280"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76280"}],"epss":null},{"id":"CVE-2026-76279","title":"CVE-2026-76279 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with th","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to write events to internal indexes outside the index access configured for the role. The vulnerability is possible because Splunk Enterprise does not normalize whitespace in an index name before applying configured index-access restrictions for the role. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and How indexing works (ht","source":"NVD","date":"2026-10-07T21:17:19.180Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76279","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76279"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76279"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76279"}],"epss":null},{"id":"CVE-2026-76278","title":"CVE-2026-76278 — In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_s","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the user does not have permission to view. The vulnerability is possible because Splunk Enterprise does not verify that the user can read the requested app before the affected REST API returns SPL2 module permission grants. For more information see Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) and Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) in the Splunk documentation.\n\nSplunk Enterprise versi","source":"NVD","date":"2026-10-07T21:17:19.043Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76278","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76278"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76278"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76278"}],"epss":null},{"id":"CVE-2026-76277","title":"CVE-2026-76277 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with th","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the username is used for a user directory. This can cause distinct native Splunk usernames to share per-user configuration data, and user-management operations can affect the wrong account or fail. For more information see Set up native Splunk authentication (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/use-the-native-splunk-platform-authentication-scheme/set-up-native-splunk-authentication) and Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-u","source":"NVD","date":"2026-10-07T21:17:18.900Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76277","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76277"],"cvss":{"score":4.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76277"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76277"}],"epss":null},{"id":"CVE-2026-76276","title":"CVE-2026-76276 — In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could retrieve original source code for the Discover Splunk Observability Cloud app through Splunk Web. The vulnerability is possible because production JavaScript bundles for the app contain embedded source maps that include original source code. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and Navigating Splunk Web (https://help.splunk.com/en/splunk-ent","source":"NVD","date":"2026-10-07T21:17:18.760Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76276","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76276"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76276"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76276"}],"epss":null},{"id":"CVE-2026-76275","title":"CVE-2026-76275 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"ad","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could access search query text and job metadata for jobs that belong to other users, including job identifiers, dispatch parameters, result counts, and execution metadata, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully enforce per-user authorization before it includes job information in search job listings.","source":"NVD","date":"2026-10-07T21:17:18.617Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76275","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76275"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76275"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76275"}],"epss":null},{"id":"CVE-2026-76274","title":"CVE-2026-76274 — In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound request from Splunk App for Splunk Observability Cloud through the Representational State Transfer (REST) API to an attacker-controlled host and disclose the configured Observability Cloud Application Programming Interface (API) token. The vulnerability is possible because Splunk App for Splunk Observability Cloud does not fully validate the destination of an outbound request. For more information see Authentication tokens (https://help.splunk.com/en/splunk-observability-cloud/administer/authentication-and-security/authentication-tokens) in the Splunk documentation.\n\nSplunk Enterprise versions 9.4.x are not affected.","source":"NVD","date":"2026-10-07T21:17:18.477Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76274","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76274"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76274"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76274"}],"epss":null},{"id":"CVE-2026-76273","title":"CVE-2026-76273 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with th","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search Processing Language (SPL) command to add attacker-controlled content to system-level messages on the Splunk platform instance. The vulnerability is possible because the collect command does not validate the index name before processing the value. For more information see collect (https://help.splunk.com/en/splunk-enterprise/search/spl-search-reference/10.4/search-commands/collect), Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities), and System endpoint descriptions (https://help.splunk.com/en/splunk-e","source":"NVD","date":"2026-10-07T21:17:18.337Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76273","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76273"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76273"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76273"}],"epss":null},{"id":"CVE-2026-76272","title":"CVE-2026-76272 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"ad","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not verify that the user is authorized to request a signature. Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72 are also affected. For more information see Define roles on the Splunk platform with capabilities (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.2/manage-splunk-platform-users-and-roles/define-roles-on-the-splunk-platform-with-capabilities) in the Splunk documentation.","source":"NVD","date":"2026-10-07T21:17:18.197Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76272","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76272"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76272"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76272"}],"epss":null},{"id":"CVE-2026-76271","title":"CVE-2026-76271 — In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could cause a denial of service against a Representational State Transfer (REST) API endpoint in the Discover Splunk Observability Cloud app. The vulnerability is possible because the app uses an inefficient regular expression to validate input submitted through the endpoint. For more information see About configuring role-based user access (https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/10.4/manage-splunk-platform-users-and-roles/about-configuring-role-based-user-access), Splunk Observability Cloud previews (https://help.splunk.com/en/splunk-enterprise/search/search-manual/10.4/observability/splunk-observability-cloud-previews), and restmap.conf (https://help.splu","source":"NVD","date":"2026-10-07T21:17:18.050Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76271","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76271"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76271"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76271"}],"epss":null},{"id":"CVE-2026-76270","title":"CVE-2026-76270 — In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capabilit","summary":"In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer (REST) API, including private SPL2 module definitions belonging to other users. The vulnerability is possible because Splunk Enterprise and Splunk Cloud Platform do not parameterize user-supplied values before using them in database queries for SPL2 module filtering. For more information see Manage SPL2 modules (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/multiple-searches-in-an-spl2-module/manage-spl2-modules) and Module permissions (https://help.splunk.com/en/splunk-enterprise/search/spl2-search-manual/modules-statements-and-views/module-permissions) in the Splunk doc","source":"NVD","date":"2026-10-07T21:17:17.907Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76270","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76270"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76270"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76270"}],"epss":null},{"id":"CVE-2026-76269","title":"CVE-2026-76269 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"ad","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other users, including search query text, job metadata, results, and preview results, through an Application Programming Interface (API) implemented as a Representational State Transfer (REST) API. The vulnerability is possible because the REST API does not fully validate job ownership before returning search job information.","source":"NVD","date":"2026-10-07T21:17:17.763Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76269","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76269"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76269"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76269"}],"epss":null},{"id":"CVE-2026-76268","title":"CVE-2026-76268 — In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the","summary":"In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled operating-system commands. The vulnerability is possible because this interface does not require authentication for critical configuration operations. For more information see Sidecar configuration settings (https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/10.2/splunk-sidecars/sidecar-configuration-settings) in the Splunk documentation.\n\nSplunk Enterprise versions 10.0.x and 9.4.x are not affected.","source":"NVD","date":"2026-10-07T21:17:17.607Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76268","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76268"],"cvss":{"score":9.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76268"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76268"}],"epss":null},{"id":"CVE-2026-76267","title":"CVE-2026-76267 — In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries into the app log through the Representational State Transfer (REST) API. The vulnerability is possible because Splunk App for Splunk O11y Cloud does not neutralize user-supplied SignalFlow content before writing it to the app log.\n\nSplunk Enterprise versions 9.4.x are not affected.","source":"NVD","date":"2026-10-07T21:17:17.467Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76267","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76267"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76267"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76267"}],"epss":null},{"id":"CVE-2026-76266","title":"CVE-2026-76266 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can ru","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk Enterprise could cause an affected Linux package upgrade to run attacker-controlled operating-system commands with root privileges. The vulnerability is possible because the Linux package maintainer script trusts existing Splunk Enterprise installation content when it performs upgrade operations with root privileges. The vulnerability requires an affected Linux package upgrade to occur after the local user modifies the installation. The local user should not be able to elevate privileges at will.","source":"NVD","date":"2026-10-07T21:17:17.310Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76266","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76266"],"cvss":{"score":7.7,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76266"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76266"}],"epss":null},{"id":"CVE-2026-76265","title":"CVE-2026-76265 — In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versio","summary":"In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does not hold the \"admin\" or \"power\" Splunk roles could access privileged Splunk Secure Gateway functionality. With this access, the user could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because multiple Splunk Secure Gateway Representational State Transfer (REST) API endpoints do not enforce authorization requirements before processing requests.","source":"NVD","date":"2026-10-07T21:17:17.150Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76265","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76265"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76265"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76265"}],"epss":null},{"id":"CVE-2026-76264","title":"CVE-2026-76264 — In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the \"ad","summary":"In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the \"admin\" or \"power\" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings.","source":"NVD","date":"2026-10-07T21:17:17.003Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76264","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-76264"],"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"psirt@cisco.com"},"read":false,"kev":false,"recordIds":["CVE-2026-76264"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76264"}],"epss":null},{"id":"CVE-2026-1403","title":"CVE-2026-1403 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 befor","summary":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.","source":"NVD","date":"2026-10-07T21:17:15.863Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1403","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-1403"],"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"cve@gitlab.com"},"read":false,"kev":false,"recordIds":["CVE-2026-1403"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1403"}],"epss":null},{"id":"CVE-2026-107363","title":"CVE-2026-107363 — In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequ","summary":"In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the Keystone token. An authenticated user with a valid token for one project may substitute another project's UUID to enumerate, inspect, create, or delete queues belonging to that project, resulting in unauthorized disclosure, modification, or loss of queue data. Only deployments using the WebSocket transport with Keystone authentication are affected.","source":"NVD","date":"2026-10-07T21:17:15.690Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107363","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107363"],"cvss":{"score":6.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"cve@mitre.org"},"read":false,"kev":false,"recordIds":["CVE-2026-107363"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107363"}],"epss":null},{"id":"CVE-2026-107229","title":"CVE-2026-107229 — The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchrono","summary":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent A-label normalization, locale-sensitive lowercasing, public-suffix host-only handling, and numeric or IP host checks allow one origin to store a cookie later sent to another origin. Applications sharing one client across trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation. This issue is fixed in version 3.0.14.","source":"NVD","date":"2026-10-07T21:17:14.613Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107229","topic":"New vulnerabilities","affected":[],"aliases":["CVE-2026-107229"],"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","source":"security-advisories@github.com"},"read":false,"kev":false,"recordIds":["CVE-2026-107229"],"sources":["NVD"],"topics":["New vulnerabilities"],"references":[{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107229"}],"epss":null},{"id":"CVE-2026-61439","title":"PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats","source":"GitHub Advisories","date":"2026-10-07T20:43:58Z","summary":"### Summary Injection Defense is a purpose-built prompt injection defense layer.  It scans LLM inputs through six detection categories: instruction overrides, authority claims, boundary manipulation, obfuscation, financial manipulation, and self-harm instructions.","url":"https://github.com/advisories/GHSA-fj8f-m44g-c479","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-61439","GHSA-FJ8F-M44G-C479"],"kev":false,"recordIds":["GHSA-fj8f-m44g-c479"],"sources":["GitHub Advisories"],"topics":["Code & supply chain"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fj8f-m44g-c479"}],"epss":{"score":0.00432,"date":"2026-10-12","percentile":0.35637}},{"id":"CVE-2026-105642","title":"Ghost: Remote Code Execution via Bookmark Card Images","source":"GitHub Advisories","date":"2026-10-07T20:43:08Z","summary":"### Impact An image processing library bundled with Ghost contained a vulnerability in its SVG handling.  Any staff user, including Contributors, could create a bookmark card for an attacker-controlled website, resulting in arbitrary commands being run on the Ghost server.","url":"https://github.com/advisories/GHSA-788w-68h3-cvxp","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105642","GHSA-788W-68H3-CVXP"],"kev":false,"recordIds":["GHSA-788w-68h3-cvxp","CVE-2026-105642"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-788w-68h3-cvxp"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105642"}],"epss":{"score":0.00251,"date":"2026-10-12","percentile":0.15215}},{"id":"CVE-2026-105643","title":"Ghost: Stored XSS via Embed Card Previews","source":"GitHub Advisories","date":"2026-10-07T20:43:05Z","summary":"### Impact Embed cards in the Ghost editor could be used to bypass the fix for GHSA-8vhf-xxpj-4qrg.  Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the post in the editor, possibly resulting in compromise of that user's admin session.","url":"https://github.com/advisories/GHSA-69qc-f5m6-889c","topic":"Code & supply chain","read":false,"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105643","GHSA-69QC-F5M6-889C"],"kev":false,"recordIds":["GHSA-69qc-f5m6-889c","CVE-2026-105643"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-69qc-f5m6-889c"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105643"}],"epss":{"score":0.00271,"date":"2026-10-12","percentile":0.17846}},{"id":"CVE-2026-105644","title":"Ghost : Stored XSS via SVG Files in Content Imports","source":"GitHub Advisories","date":"2026-10-07T20:43:03Z","summary":"### Impact SVG images included in content imports were stored without sanitization.  An attacker who convinced an Administrator to import a crafted file could host scripts on the site's domain, possibly resulting in compromise of staff users' admin sessions.","url":"https://github.com/advisories/GHSA-hqq2-xqr2-fmx2","topic":"Code & supply chain","read":false,"cvss":{"score":6.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105644","GHSA-HQQ2-XQR2-FMX2"],"kev":false,"recordIds":["GHSA-hqq2-xqr2-fmx2","CVE-2026-105644"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-hqq2-xqr2-fmx2"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105644"}],"epss":{"score":0.0032,"date":"2026-10-12","percentile":0.23086}},{"id":"CVE-2026-105645","title":"Ghost: Regular Expression Denial of Service in External Media Inliner","source":"GitHub Advisories","date":"2026-10-07T20:43:00Z","summary":"### Impact A crafted request to the external media inliner could cause excessive CPU usage, making the Ghost server unresponsive.  Exploiting this requires Administrator access.","url":"https://github.com/advisories/GHSA-9m4w-fmjw-fvjq","topic":"Code & supply chain","read":false,"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105645","GHSA-9M4W-FMJW-FVJQ"],"kev":false,"recordIds":["GHSA-9m4w-fmjw-fvjq","CVE-2026-105645"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9m4w-fmjw-fvjq"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105645"}],"epss":{"score":0.00327,"date":"2026-10-12","percentile":0.23869}},{"id":"CVE-2026-105646","title":"Ghost: Regular Expression Denial of Service in Content Import","source":"GitHub Advisories","date":"2026-10-07T20:42:53Z","summary":"### Impact A crafted content import file could cause excessive CPU usage, making the Ghost server unresponsive.  Exploiting this requires Administrator access.","url":"https://github.com/advisories/GHSA-fwh9-qg68-vxp4","topic":"Code & supply chain","read":false,"cvss":{"score":4.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105646","GHSA-FWH9-QG68-VXP4"],"kev":false,"recordIds":["GHSA-fwh9-qg68-vxp4","CVE-2026-105646"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-fwh9-qg68-vxp4"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105646"}],"epss":{"score":0.00327,"date":"2026-10-12","percentile":0.2387}},{"id":"CVE-2026-106121","title":"RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS","source":"GitHub Advisories","date":"2026-10-07T20:42:33Z","summary":"read()` never returns when its input ends inside a quoted string or a `//` line comment.  DONE` (`￿`) they loop forever.","url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m","topic":"Code & supply chain","read":false,"cvss":{"score":7.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"nvd@nist.gov"},"aliases":["CVE-2026-106121","GHSA-CQGH-8P3P-MX4M"],"kev":false,"recordIds":["GHSA-cqgh-8p3p-mx4m","CVE-2026-106121"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vmware","product":"rabbitmq_java_client"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cqgh-8p3p-mx4m"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106121"}],"epss":{"score":0.00501,"date":"2026-10-12","percentile":0.41134}},{"id":"CVE-2026-105742","title":"Docling: Configured HTTP headers sent to every remote image host named by a document","source":"GitHub Advisories","date":"2026-10-07T20:42:24Z","summary":"headers` is documented for passing authentication headers (API keys, bearer tokens) when fetching remote images.  docling sends these headers on every remote image request, to whichever host the document names.","url":"https://github.com/advisories/GHSA-p3fw-7699-7926","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","source":"nvd@nist.gov"},"aliases":["CVE-2026-105742","GHSA-P3FW-7699-7926"],"kev":false,"recordIds":["GHSA-p3fw-7699-7926","CVE-2026-105742"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p3fw-7699-7926"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105742"}],"epss":{"score":0.00226,"date":"2026-10-12","percentile":0.12311}},{"id":"CVE-2026-105743","title":"Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)","source":"GitHub Advisories","date":"2026-10-07T20:42:19Z","summary":"### Summary When remote fetching is enabled (`enable_remote_fetch=True`, together with `fetch_images=True` or HTML `render_page=True`), docling's protection against requests to private and loopback addresses can be bypassed.  - The URL check resolves the host name once, to a single IPv4 address.","url":"https://github.com/advisories/GHSA-pc36-qwjq-x68c","topic":"Code & supply chain","read":false,"cvss":{"score":5.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"nvd@nist.gov"},"aliases":["CVE-2026-105743","GHSA-PC36-QWJQ-X68C"],"kev":false,"recordIds":["GHSA-pc36-qwjq-x68c","CVE-2026-105743"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pc36-qwjq-x68c"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105743"}],"epss":{"score":0.0019,"date":"2026-10-12","percentile":0.07968}},{"id":"CVE-2026-105744","title":"Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine","source":"GitHub Advisories","date":"2026-10-07T20:42:05Z","summary":"### Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions(tikz_engine=\"tectonic\")`), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives.  tex` file can read files the process can read and write files at paths the process can write.","url":"https://github.com/advisories/GHSA-x3q2-h9hx-4r4j","topic":"Code & supply chain","read":false,"cvss":{"score":8.8,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"aliases":["CVE-2026-105744","GHSA-X3Q2-H9HX-4R4J"],"kev":false,"recordIds":["GHSA-x3q2-h9hx-4r4j","CVE-2026-105744"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-x3q2-h9hx-4r4j"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105744"}],"epss":{"score":0.00344,"date":"2026-10-12","percentile":0.26012}},{"id":"CVE-2026-105748","title":"Docling: Crafted DoclingDocument JSON embeds local image files into converted output","source":"GitHub Advisories","date":"2026-10-07T20:41:08Z","summary":"JSON_DOCLING`, enabled by default).  A crafted JSON file can set a picture's image `uri` to a local file path.","url":"https://github.com/advisories/GHSA-p944-4xh2-x776","topic":"Code & supply chain","read":false,"cvss":{"score":4.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105748","GHSA-P944-4XH2-X776"],"kev":false,"recordIds":["GHSA-p944-4xh2-x776","CVE-2026-105748"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p944-4xh2-x776"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105748"}],"epss":{"score":0.00222,"date":"2026-10-12","percentile":0.11707}},{"id":"CVE-2026-105749","title":"Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion","source":"GitHub Advisories","date":"2026-10-07T20:41:02Z","summary":"### Summary The HTML, JATS, ODS (OpenDocument spreadsheet) and BoxNote backends accept table `rowspan` / `colspan` values without an upper bound.  A few bytes of input, such as ` `, make docling run loops proportional to the declared span and allocate a table grid of the declared size.","url":"https://github.com/advisories/GHSA-cgc7-9qp3-86m3","topic":"Code & supply chain","read":false,"cvss":{"score":6.5,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105749","GHSA-CGC7-9QP3-86M3"],"kev":false,"recordIds":["GHSA-cgc7-9qp3-86m3","CVE-2026-105749"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cgc7-9qp3-86m3"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105749"}],"epss":{"score":0.00266,"date":"2026-10-12","percentile":0.17062}},{"id":"CVE-2026-105745","title":"Docling imports plugin entry points before the allow_external_plugins check","source":"GitHub Advisories","date":"2026-10-07T20:40:56Z","summary":"### Summary `allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own model plugins.  However, docling's plugin factories call pluggy's `load_setuptools_entrypoints()`, which imports every module registered under docling's plugin entry-point group.","url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","topic":"Code & supply chain","read":false,"cvss":{"score":7.8,"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"nvd@nist.gov"},"aliases":["CVE-2026-105745","GHSA-9JXX-VJRV-H2RQ"],"kev":false,"recordIds":["GHSA-9jxx-vjrv-h2rq","CVE-2026-105745"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"docling","product":"docling"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105745"}],"epss":{"score":0.0012,"date":"2026-10-12","percentile":0.01686}},{"id":"CVE-2026-105697","title":"Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration","source":"GitHub Advisories","date":"2026-10-07T20:36:35Z","summary":"\"`.  ).","url":"https://github.com/advisories/GHSA-w794-rj3p-xv45","topic":"Code & supply chain","read":false,"cvss":{"score":9.9,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105697","GHSA-W794-RJ3P-XV45"],"kev":false,"recordIds":["GHSA-w794-rj3p-xv45","CVE-2026-105697"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-w794-rj3p-xv45"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105697"}],"epss":{"score":0.00471,"date":"2026-10-12","percentile":0.38954}},{"id":"CVE-2026-105698","title":"Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints","source":"GitHub Advisories","date":"2026-10-07T20:36:25Z","summary":"1**, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - `POST /api/v1/build/{flow_id}/vertices` (`retrieve_vertices_order`) - `POST /api/v1/build/{flow_id}/vertices/{vertex_id}` (`build_vertex`) Any authenticated user who knows (or obtains) another user's `flow_id` could load that user's private flow graph, enumerate its vertex IDs, and build (execute) individual vertices of it, receiving the vertex results in the response.  Both routes are declared with `deprecated=True, include_in_schema=False`, so they do not appear in the OpenAPI docs, but they remained registered on the router.","url":"https://github.com/advisories/GHSA-gh98-4phw-6fmw","topic":"Code & supply chain","read":false,"cvss":{"score":5.4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105698","GHSA-GH98-4PHW-6FMW"],"kev":false,"recordIds":["GHSA-gh98-4phw-6fmw","CVE-2026-105698"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-gh98-4phw-6fmw"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105698"}],"epss":{"score":0.00177,"date":"2026-10-12","percentile":0.06714}},{"id":"CVE-2026-106451","title":"yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user","source":"GitHub Advisories","date":"2026-10-07T20:35:51Z","summary":"load`.  The path of the extracted library can be predicted before it is created, and the library file is opened without exclusive creation.","url":"https://github.com/advisories/GHSA-mcr4-qmvw-px4g","topic":"Code & supply chain","read":false,"cvss":{"score":7.3,"version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-106451","GHSA-MCR4-QMVW-PX4G"],"kev":false,"recordIds":["GHSA-mcr4-qmvw-px4g","CVE-2026-106451"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mcr4-qmvw-px4g"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106451"}],"epss":{"score":0.00083,"date":"2026-10-12","percentile":0.00227}},{"id":"CVE-2026-106449","title":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError","source":"GitHub Advisories","date":"2026-10-07T20:35:46Z","summary":"### Summary When `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively.  A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.","url":"https://github.com/advisories/GHSA-343h-94h5-c4wr","topic":"Code & supply chain","read":false,"cvss":{"score":3.7,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-106449","GHSA-343H-94H5-C4WR"],"kev":false,"recordIds":["GHSA-343h-94h5-c4wr","CVE-2026-106449"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-343h-94h5-c4wr"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449"}],"epss":{"score":0.00339,"date":"2026-10-12","percentile":0.25366}},{"id":"CVE-2026-106450","title":"yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs","source":"GitHub Advisories","date":"2026-10-07T20:35:40Z","summary":"### Summary `LZ4FrameInputStream` allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header.  Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes.","url":"https://github.com/advisories/GHSA-gm45-99xc-r7wv","topic":"Code & supply chain","read":false,"cvss":{"score":5.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"GitHub Advisories"},"aliases":["CVE-2026-106450","GHSA-GM45-99XC-R7WV"],"kev":false,"recordIds":["GHSA-gm45-99xc-r7wv","CVE-2026-106450"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-gm45-99xc-r7wv"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450"}],"epss":{"score":0.00371,"date":"2026-10-12","percentile":0.29118}},{"id":"CVE-2026-105647","title":"Ghost: Server-Side Request Forgery in Bookmark Fetching","source":"GitHub Advisories","date":"2026-10-07T20:35:32Z","summary":"### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network.  A successful attack would not result in any response data being returned.","url":"https://github.com/advisories/GHSA-322m-ff4g-9vx9","topic":"Code & supply chain","read":false,"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105647","GHSA-322M-FF4G-9VX9"],"kev":false,"recordIds":["GHSA-322m-ff4g-9vx9","CVE-2026-105647"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-322m-ff4g-9vx9"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105647"}],"epss":{"score":0.0023,"date":"2026-10-12","percentile":0.12716}},{"id":"CVE-2026-105648","title":"Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses","source":"GitHub Advisories","date":"2026-10-07T20:35:27Z","summary":"### Impact A validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network on some network configurations.  A successful attack would not result in any response data being returned.","url":"https://github.com/advisories/GHSA-r7f2-6fj8-6fg2","topic":"Code & supply chain","read":false,"cvss":{"score":4,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105648","GHSA-R7F2-6FJ8-6FG2"],"kev":false,"recordIds":["GHSA-r7f2-6fj8-6fg2","CVE-2026-105648"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-r7f2-6fj8-6fg2"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105648"}],"epss":{"score":0.00298,"date":"2026-10-12","percentile":0.20713}},{"id":"CVE-2026-105649","title":"Ghost: Stored XSS via SVG Uploads Bypassing Sanitization","source":"GitHub Advisories","date":"2026-10-07T20:35:22Z","summary":"### Impact SVG media thumbnails, and SVG images uploaded with a non-SVG file extension, were stored without sanitization.  This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions.","url":"https://github.com/advisories/GHSA-8575-cr6v-7jh4","topic":"Code & supply chain","read":false,"cvss":{"score":7.3,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","source":"GitHub Advisories"},"aliases":["CVE-2026-105649","GHSA-8575-CR6V-7JH4"],"kev":false,"recordIds":["GHSA-8575-cr6v-7jh4","CVE-2026-105649"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-8575-cr6v-7jh4"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105649"}],"epss":{"score":0.00302,"date":"2026-10-12","percentile":0.21136}},{"id":"CVE-2026-105699","title":"Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers","source":"GitHub Advisories","date":"2026-10-07T20:35:12Z","summary":"### Summary Langflow's project-scoped MCP transport authenticates the caller for the `project_id` in the connection URL, but the subsequent `resources/read` operation does not authorize the resource URI being requested.  An authenticated user can connect to their own project-scoped MCP endpoint and supply a crafted file-download URI that points to another user's flow-backed file.","url":"https://github.com/advisories/GHSA-4hmc-cfm3-w43c","topic":"Code & supply chain","read":false,"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-105699","GHSA-4HMC-CFM3-W43C"],"kev":false,"recordIds":["GHSA-4hmc-cfm3-w43c","CVE-2026-105699"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4hmc-cfm3-w43c"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105699"}],"epss":{"score":0.00246,"date":"2026-10-12","percentile":0.1463}},{"id":"CVE-2026-94544","title":"Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages","source":"GitHub Advisories","date":"2026-10-07T20:32:13Z","summary":"Pending `use cache` fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests.  When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives unpublished content, without any authentication.","url":"https://github.com/advisories/GHSA-3w37-wq28-93x7","topic":"Code & supply chain","read":false,"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94544","GHSA-3W37-WQ28-93X7"],"kev":false,"recordIds":["GHSA-3w37-wq28-93x7","CVE-2026-94544"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-3w37-wq28-93x7"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94544"}],"epss":{"score":0.00179,"date":"2026-10-12","percentile":0.06873}},{"id":"CVE-2026-94543","title":"Next.js has cache poisoning of SSG and ISR pages in self-hosted applications","source":"GitHub Advisories","date":"2026-10-07T20:32:06Z","summary":"js applications that use the Pages Router with statically generated (SSG) or incrementally regenerated (ISR) pages can have a page's cache entry replaced with content from a different route, causing the affected page to serve wrong content to every visitor until the entry is revalidated.  Applications deployed on Vercel are not affected.","url":"https://github.com/advisories/GHSA-4jqv-mc3x-m676","topic":"Code & supply chain","read":false,"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94543","GHSA-4JQV-MC3X-M676"],"kev":false,"recordIds":["GHSA-4jqv-mc3x-m676","CVE-2026-94543"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"},{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-4jqv-mc3x-m676"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94543"}],"epss":{"score":0.00288,"date":"2026-10-12","percentile":0.19634}},{"id":"CVE-2026-94486","title":"Next.js has information disclosure in development server's Model Context Protocol endpoint","source":"GitHub Advisories","date":"2026-10-07T20:31:51Z","summary":"js development server (`next dev`) exposes a Model Context Protocol endpoint that does not verify which website a request originates from, allowing a malicious website visited by the developer to read sensitive development data — including the project's location on disk, source code snippets from error reports, the route inventory, and development logs.  Only applications run with `next dev` are affected.","url":"https://github.com/advisories/GHSA-39w2-rjm5-chcv","topic":"Code & supply chain","read":false,"cvss":{"score":2.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94486","GHSA-39W2-RJM5-CHCV"],"kev":false,"recordIds":["GHSA-39w2-rjm5-chcv","CVE-2026-94486"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-39w2-rjm5-chcv"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94486"}],"epss":{"score":0.00114,"date":"2026-10-12","percentile":0.01361}},{"id":"CVE-2026-94485","title":"Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass","source":"GitHub Advisories","date":"2026-10-07T20:31:33Z","summary":"js App Router applications built with webpack, metadata image routes such as opengraph-image and twitter-image ignore the `dynamicParams` route segment option.  An attacker can request metadata image URLs for dynamic segments that were deliberately excluded from `generateStaticParams()`.","url":"https://github.com/advisories/GHSA-f87g-xv8r-7p7x","topic":"Code & supply chain","read":false,"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94485","GHSA-F87G-XV8R-7P7X"],"kev":false,"recordIds":["GHSA-f87g-xv8r-7p7x","CVE-2026-94485"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-f87g-xv8r-7p7x"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94485"}],"epss":{"score":0.00145,"date":"2026-10-12","percentile":0.03307}},{"id":"CVE-2026-94484","title":"Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service","source":"GitHub Advisories","date":"2026-10-07T20:31:13Z","summary":"js applications that use a root-level catch-all page together with statically generated or Incremental Static Regeneration routes can have their shared response cache poisoned by a single unauthenticated crafted request. Review the original advisory for affected versions and fixes.","url":"https://github.com/advisories/GHSA-mcj8-r9mp-w47p","topic":"Code & supply chain","read":false,"cvss":{"score":6.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94484","GHSA-MCJ8-R9MP-W47P"],"kev":false,"recordIds":["GHSA-mcj8-r9mp-w47p","CVE-2026-94484"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"},{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-mcj8-r9mp-w47p"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94484"}],"epss":{"score":0.00244,"date":"2026-10-12","percentile":0.14455}},{"id":"CVE-2026-94483","title":"Next.js has Server-Side Request Forgery in Image Optimization","source":"GitHub Advisories","date":"2026-10-07T20:30:55Z","summary":"g.  to private IPs) during Image Optimization.","url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4","topic":"Code & supply chain","read":false,"cvss":{"score":8.3,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-94483","GHSA-CJQ9-62Q9-8JV4"],"kev":false,"recordIds":["GHSA-cjq9-62q9-8jv4","CVE-2026-94483"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[{"vendor":"vercel","product":"next.js"}],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-cjq9-62q9-8jv4"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94483"}],"epss":{"score":0.00244,"date":"2026-10-12","percentile":0.1442}},{"id":"CVE-2026-105856","title":"Payload: SQL injection in SQLite/Postgres","source":"GitHub Advisories","date":"2026-10-07T20:30:04Z","summary":"### Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres.  #### You are affected if: - You use `@payloadcms/db-sqlite` or `@payloadcms/db-d1-sqlite`.","url":"https://github.com/advisories/GHSA-pj7x-6wpf-pgvp","topic":"Code & supply chain","read":false,"cvss":{"score":8.6,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-105856","GHSA-PJ7X-6WPF-PGVP"],"kev":false,"recordIds":["GHSA-pj7x-6wpf-pgvp","CVE-2026-105856"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-pj7x-6wpf-pgvp"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105856"}],"epss":{"score":0.00269,"date":"2026-10-12","percentile":0.17584}},{"id":"CVE-2026-105858","title":"Payload: Remote Code Execution through first-register","source":"GitHub Advisories","date":"2026-10-07T20:29:58Z","summary":"### Impact A crafted request to the public first-register operation can be used to perform a RCE exploit.  **You are affected if:** - You use local auth strategy and your application remains without an initial user created ## Patches In the patched version data submission to create first user is properly sanitized.","url":"https://github.com/advisories/GHSA-97rh-rhh2-7vjv","topic":"Code & supply chain","read":false,"cvss":{"score":8.1,"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GitHub Advisories"},"aliases":["CVE-2026-105858","GHSA-97RH-RHH2-7VJV"],"kev":false,"recordIds":["GHSA-97rh-rhh2-7vjv","CVE-2026-105858"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-97rh-rhh2-7vjv"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105858"}],"epss":{"score":0.00482,"date":"2026-10-12","percentile":0.39707}},{"id":"CVE-2026-105860","title":"Payload has a tenant authorization bypass in Multi-Tenant Plugin","source":"GitHub Advisories","date":"2026-10-07T20:29:53Z","summary":"## Impact When using the default tenant array field access, an authenticated user could assign themselves to other tenants.  create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.","url":"https://github.com/advisories/GHSA-p96c-xwx8-3cqj","topic":"Code & supply chain","read":false,"cvss":{"score":7.1,"version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","source":"security-advisories@github.com"},"aliases":["CVE-2026-105860","GHSA-P96C-XWX8-3CQJ"],"kev":false,"recordIds":["GHSA-p96c-xwx8-3cqj","CVE-2026-105860"],"sources":["GitHub Advisories","NVD"],"topics":["Code & supply chain","New vulnerabilities"],"affected":[],"references":[{"source":"GitHub Advisories","url":"https://github.com/advisories/GHSA-p96c-xwx8-3cqj"},{"source":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105860"}],"epss":{"score":0.00238,"date":"2026-10-12","percentile":0.13679}}]}