Security Box Score — October 8, 2026 — page 2
Edition of October 8, 2026, continued — page 2 of 2. Back to page 1
Transactions (continued)
ENRICHED — CVE-2019-12972. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-13602. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2019-13962. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-14250. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-14379. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-14439. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2019-14540. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-14565 (Intel 2019.2 IPU – Intel(R) SGX). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2019-14566 (Intel 2019.2 IPU – Intel(R) SGX). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2019-15217. Received CVSS 4.6 and CPE data from NVD.
ENRICHED — CVE-2019-15218. Received CVSS 4.6 and CPE data from NVD.
ENRICHED — CVE-2019-15219. Received CVSS 4.6 and CPE data from NVD.
ENRICHED — CVE-2019-15807. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-16089. Received CVSS 4.1 and CPE data from NVD.
ENRICHED — CVE-2019-16335. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-16866. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2019-16869. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2019-16942. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-17531. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2019-17543. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2019-18806. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-19054. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-19066. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-19080. Received CVSS 5.9 and CPE data from NVD.
ENRICHED — CVE-2019-19081. Received CVSS 5.9 and CPE data from NVD.
ENRICHED — CVE-2019-19082. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-19083. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-19244. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2019-19462. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-19530. Received CVSS 4.6 and CPE data from NVD.
ENRICHED — CVE-2019-19721. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2019-19965. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-20095. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-20383. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2019-20444. Received CVSS 9.1 and CPE data from NVD.
ENRICHED — CVE-2019-20445. Received CVSS 9.1 and CPE data from NVD.
ENRICHED — CVE-2019-20794. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2019-20838. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2019-20920. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2019-5459 (VLC). Received CVSS 7.1 and CPE data from NVD.
ENRICHED — CVE-2019-5460 (VLC Media Player). Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2019-8906. Received CVSS 4.4 and CPE data from NVD.
ENRICHED — CVE-2019-9674. Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2020-0570 (QT Library). Received CVSS 7.3 and CPE data from NVD.
ENRICHED — CVE-2020-11494. Received CVSS 4.4 and CPE data from NVD.
ENRICHED — CVE-2020-11609. Received CVSS 4.3 and CPE data from NVD.
ENRICHED — CVE-2020-11619. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-11620. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-11979 (Apache Ant). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2020-11987 (Apache Batik). Received CVSS 8.2 and CPE data from NVD.
ENRICHED — CVE-2020-12321 (Intel(R) Wireless Bluetooth(R)). Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2020-12322 (Intel(R) Wireless Bluetooth(R)). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-12357 (Intel(R) Processors). Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2020-12358 (Intel(R) Processors). Received CVSS 4.4 and CPE data from NVD.
ENRICHED — CVE-2020-12769. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2020-14060. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-14062. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-14155. Received CVSS 5.3 and CPE data from NVD.
ENRICHED — CVE-2020-14195. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-14416. Received CVSS 4.2 and CPE data from NVD.
ENRICHED — CVE-2020-14422. Received CVSS 5.9 and CPE data from NVD.
ENRICHED — CVE-2020-15523. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2020-17521 (Apache Software Foundation Apache Groovy). Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2020-19188. Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-24486 (Intel(R) Processors). Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2020-24489 (Intel(R) VT-d products). Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2020-24511 (Intel(R) Processors). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-24512 (Intel(R) Processors). Received CVSS 3.3 and CPE data from NVD.
ENRICHED — CVE-2020-24513 (Intel Atom(R) Processors). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-24616. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-24742. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2020-24750. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-25649 (jackson-databind). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2020-26116. Received CVSS 7.2 and CPE data from NVD.
ENRICHED — CVE-2020-26140. Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-26144. Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-26664. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2020-27170. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2020-27171. Received CVSS 6.0 and CPE data from NVD.
ENRICHED — CVE-2020-27619. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2020-28097. Received CVSS 5.9 and CPE data from NVD.
ENRICHED — CVE-2020-29374. Received CVSS 3.6 and CPE data from NVD.
ENRICHED — CVE-2020-35490. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-35491. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36183. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36185. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36186. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36187. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36188. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36189. Received CVSS 8.1 and CPE data from NVD.
ENRICHED — CVE-2020-36311. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2020-36327. Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2020-36558. Received CVSS 5.1 and CPE data from NVD.
ENRICHED — CVE-2020-3702 (Qualcomm, Inc. Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2020-7598 (minimist). Received CVSS 5.6 and CPE data from NVD.
ENRICHED — CVE-2020-7639 (@eivifj/dot). Received CVSS 5.3 and CPE data from NVD.
ENRICHED — CVE-2020-8670 (Intel(R) Processors). Received CVSS 6.4 and CPE data from NVD.
ENRICHED — CVE-2020-8700 (Intel(R) Processors). Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2020-8840. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-0095 (Intel(R) Processors). Received CVSS 4.4 and CPE data from NVD.
ENRICHED — CVE-2021-0114 (Intel(R) Processors). Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2021-0146 (Intel(R) processors which). Received CVSS 6.8 and CPE data from NVD.
ENRICHED — CVE-2021-20193 (tar). Received CVSS 3.3 and CPE data from NVD.
ENRICHED — CVE-2021-24032 (Facebook Zstandard). Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2021-27568. Received CVSS 5.9 and CPE data from NVD.
ENRICHED — CVE-2021-28972. Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2021-29921. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-31879. Received CVSS 6.1 and CPE data from NVD.
ENRICHED — CVE-2021-3331. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-33624. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2021-33656 (openEuler:kernel). Received CVSS 6.8 and CPE data from NVD.
ENRICHED — CVE-2021-34141. Received CVSS 5.3 and CPE data from NVD.
ENRICHED — CVE-2021-34556. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-34693. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-3520 (lz4). Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-35477. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-35517 (Apache Software Foundation Apache Commons Compress). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2021-3572 (python-pip). Received CVSS 5.7 and CPE data from NVD.
ENRICHED — CVE-2021-36090 (Apache Software Foundation Apache Commons Compress). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2021-37136 (The Netty project Netty). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2021-37137 (The Netty project Netty). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2021-37159. Received CVSS 6.4 and CPE data from NVD.
ENRICHED — CVE-2021-3733 (python). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2021-38166. Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2021-38198. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-38199. Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2021-38206. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-39537. Received CVSS 8.8 and CPE data from NVD.
ENRICHED — CVE-2021-40158 (Inventor). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2021-40159 (Inventor). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2021-40690 (Apache Software Foundation Apache Santuario). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2021-41617. Received CVSS 7.0 and CPE data from NVD.
ENRICHED — CVE-2021-43975. Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2021-44906. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2021-45402. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2021-46195. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-0529 (unzip). Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-0530 (unzip). Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-0987 (PackageKit). Received CVSS 3.3 and CPE data from NVD.
ENRICHED — CVE-2022-1665 (Red Hat Enterprise Linux). Received CVSS 8.2 and CPE data from NVD.
ENRICHED — CVE-2022-20153 (Android). Received CVSS 6.7 and CPE data from NVD.
ENRICHED — CVE-2022-20154 (Android). Received CVSS 6.4 and CPE data from NVD.
ENRICHED — CVE-2022-23437 (Apache Software Foundation Apache Xerces). Received CVSS 6.5 and CPE data from NVD.
ENRICHED — CVE-2022-23456. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-23960. Received CVSS 5.6 and CPE data from NVD.
ENRICHED — CVE-2022-25788 (Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2022-26488. Received CVSS 7.0 and CPE data from NVD.
ENRICHED — CVE-2022-26878. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-27867 (Autodesk Inventor, Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD Electrical, AutoCAD Map 3D, AutoCAD Mechanical, AutoCAD MEP, AutoCAD Plant 3D). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2022-29577. Received CVSS 6.1 and CPE data from NVD.
ENRICHED — CVE-2022-32189 (Go standard library math/big). Received CVSS 7.5 and CPE data from NVD.
ENRICHED — CVE-2022-32511. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2022-33070. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2022-36227. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2022-41850. Received CVSS 4.7 and CPE data from NVD.
ENRICHED — CVE-2022-44729 (Apache Software Foundation Apache XML Graphics Batik). Received CVSS 7.1 and CPE data from NVD.
ENRICHED — CVE-2023-41139 (Autodesk AutoCAD, Advance Steel and Civil 3D). Received CVSS 7.8 and CPE data from NVD.
ENRICHED — CVE-2023-42366. Received CVSS 5.5 and CPE data from NVD.
ENRICHED — CVE-2023-48161. Received CVSS 7.1 and CPE data from NVD.
ENRICHED — CVE-2023-51714. Received CVSS 9.8 and CPE data from NVD.
ENRICHED — CVE-2023-51764. Received CVSS 5.3 and CPE data from NVD.
ENRICHED — CVE-2026-106195 (Google Chrome). Received CVSS 9.1 and CPE data from NVD.
ENRICHED — CVE-2026-106208 (Google Chrome). Received CVSS 6.1 and CPE data from NVD.
ENRICHED — CVE-2026-42616. Received CVSS 7.8 and CPE data from NVD.
| CVE | CVSS | EPSS %ile | Vendor | Product | CWE | Title |
|---|---|---|---|---|---|---|
| CVE-2026-107613 | 5.9 | — | GlavSoft | TightVNC | CWE-476 | NULL pointer dereference in TightVNC Server Win8ScreenDriver after failed DXG… |
| CVE-2026-107714 | 5.9 | — | sparklemotion | mechanize | CWE-200 | Mechanize sends credential headers to a different scheme or port after a redi… |
| CVE-2026-107721 | 5.9 | — | nearform | fast-jwt | CWE-613 | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validati… |
| CVE-2026-107677 | 5.7 | — | FFmpeg | FFmpeg | CWE-835 | FFmpeg through 9.0.2 DASH Demuxer Infinite Loop via Empty SegmentTemplate Media |
| CVE-2026-107678 | 5.7 | — | FFmpeg | FFmpeg | CWE-674 | FFmpeg through 9.0.2 Stack Exhaustion via Recursive Free of pssh Boxes |
| CVE-2026-107737 | 5.7 | — | sumatrapdfreader | sumatrapdf | CWE-129 | SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup |
| CVE-2026-84032 | 5.6 | — | IBM | Guardium Data Protection | CWE-295 | IBM Guardium Data Protection is affected by multiple vulnerabilities |
| CVE-2026-12109 | 5.5 | — | IBM | Security Verify Access | CWE-787 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-61801 | 5.5 | — | moby | sys | CWE-400 | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and… |
| CVE-2026-107651 | 5.5 | — | Red Hat | Red Hat Enterprise Linux 6 | CWE-122 | Eog: eog: arbitrary code execution via heap buffer overflow in png metadata r… |
| CVE-2026-107729 | 5.5 | — | sumatrapdfreader | sumatrapdf | CWE-125 | SumatraPDF: Unsigned-to-signed hdrLen validation bypass in SumatraPDF MOBI pa… |
| CVE-2026-107730 | 5.5 | — | sumatrapdfreader | sumatrapdf | CWE-190 | SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-… |
| CVE-2026-107731 | 5.5 | — | sumatrapdfreader | sumatrapdf | CWE-125 | SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and… |
| CVE-2026-13258 | 5.4 | — | IBM | DataPower Gateway 10.6CD | CWE-79 | IBM DataPower Gateway Cross-Site Scripting |
| CVE-2026-16830 | 5.4 | — | IBM | Security Verify Access | CWE-89 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-78407 | 5.4 | — | IBM | Security Verify Access | — | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-102368 | 5.4 | — | TP-Link System Inc. | Tapo S505 v1.6 | CWE-312 | Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware |
| CVE-2026-105888 | 5.4 | — | Liquid Web / StellarWP | Event Tickets | CWE-862 | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-107334 | 5.4 | — | CISA | Malcolm | CWE-863 | Incorrect Authorization in Malcolm |
| CVE-2026-107380 | 5.4 | — | darylldoyle | svg-sanitizer | CWE-79 | enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Ref… |
| CVE-2026-107396 | 5.4 | — | indico | indico | CWE-692 | Indico: Cross-Site-Scripting in link fields |
| CVE-2026-107735 | 5.4 | — | sumatrapdfreader | sumatrapdf | CWE-636 | SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open … |
| CVE-2026-16177 | 5.3 | — | IBM | DataPower Gateway 10.6CD | CWE-125 | IBM DataPower Gateway Out-of-bounds Read |
| CVE-2026-19585 | 5.3 | — | HashiCorp | Shared library | CWE-22 | Go-getter vulnerable to a path traversal in S3/GCS directory download handling |
| CVE-2026-42698 | 5.3 | — | Themeum | Tutor LMS | CWE-362 | WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability |
| CVE-2026-62128 | 5.3 | — | Creator LMS | Creator LMS | CWE-862 | WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability |
| CVE-2026-88257 | 5.3 | — | ScriptKittyOS | beam_mcp | CWE-20 | beam_mcp: nested tool argument constraints advertised but not enforced |
| CVE-2026-103517 | 5.3 | — | Unknown | Airwallex Online Payments Gateway | CWE-345 | Airwallex Online Payments Gateway < 1.36.0 - Unauthenticated Payment Bypass v… |
| CVE-2026-104671 | 5.3 | — | Unknown | TutorStarter | CWE-862 | TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX |
| CVE-2026-105190 | 5.3 | — | Unknown | Easy Digital Downloads | CWE-862 | Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Regist… |
| CVE-2026-105275 | 5.3 | — | Satel | Satel Netco Design | CWE-23 | Satel Netco Design Relative Path Traversal |
| CVE-2026-105829 | 5.3 | — | thephpleague | commonmark | CWE-80 | League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass |
| CVE-2026-105831 | 5.3 | — | espocrm | espocrm | CWE-79 | EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture … |
| CVE-2026-105832 | 5.3 | — | espocrm | espocrm | CWE-287 | EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Unauthenticated Routes |
| CVE-2026-105878 | 5.3 | — | YITH | YITH WooCommerce Product Bundles | CWE-862 | WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access C… |
| CVE-2026-105893 | 5.3 | — | Liquid Web / StellarWP | Event Tickets | CWE-639 | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-106434 | 5.3 | — | MongoDB | libmongocrypt | CWE-354 | Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt |
| CVE-2026-106596 | 5.3 | — | Visual Composer | Visual Composer Website Builder | CWE-862 | WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access C… |
| CVE-2026-106600 | 5.3 | — | Liquid Web / StellarWP | GiveWP | CWE-862 | WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability |
| CVE-2026-107298 | 5.3 | — | mcollina | msgpack5 | CWE-674 | msgpack5: Deeply nested input can exhaust the decoder stack |
| CVE-2026-107575 | 5.3 | — | Progressive Robot Ltd | hMailServer | CWE-407 | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107585 | 5.3 | — | Progressive Robot Ltd | hMailServer | CWE-770 | Allocation of Resources Without Limits or Throttling in hMailServer |
| CVE-2026-107637 | 5.3 | — | ph7software | ph7builder | CWE-639 | pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action |
| CVE-2026-107697 | 5.3 | — | FFmpeg | FFmpeg | CWE-693 | FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist() |
| CVE-2026-107698 | 5.3 | — | FFmpeg | FFmpeg | CWE-918 | FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling |
| CVE-2026-107702 | 5.3 | — | Webkul | QloApps | CWE-639 | QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking |
| CVE-2026-107706 | 5.3 | — | Dolibarr | dolibarr | CWE-863 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php |
| CVE-2026-107792 | 5.3 | — | banq | jivejdon | CWE-862 | Jivejdon through commit ee67a65e Missing Authorization via /message/threadToF… |
| CVE-2026-107793 | 5.3 | — | banq | jivejdon | CWE-639 | Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete |
| CVE-2026-107796 | 5.3 | — | banq | jivejdon | CWE-79 | Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID… |
| CVE-2026-107797 | 5.3 | — | banq | jivejdon | CWE-79 | Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters |
| CVE-2026-107831 | 5.3 | — | banq | jivejdon | CWE-352 | Jivejdon through 5.0 CSRF via GET-based Account and Thread Actions |
| CVE-2026-105331 | 5.2 | — | Checkmk GmbH | Checkmk | CWE-426 | mk-oracle: Local privilege escalation via malicious Oracle Instant Client |
| CVE-2026-84290 | 5.1 | — | IBM | Guardium Data Protection | CWE-119 | Security vulnerability affects the Windows S-TAP component as part of IBM Gua… |
| CVE-2026-106438 | 5.1 | — | MongoDB | C Driver | CWE-682 | Silent Decimal128 value corruption via incorrect exactness check in MongoDB C… |
| CVE-2026-107565 | 5.1 | — | Red Hat | Red Hat Enterprise Linux 10 | CWE-1284 | Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata alloca… |
| CVE-2026-107798 | 5.1 | — | banq | jivejdon | CWE-79 | Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle R… |
| CVE-2026-107799 | 5.1 | — | banq | jivejdon | CWE-79 | Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering |
| CVE-2026-107800 | 5.1 | — | banq | jivejdon | CWE-79 | Jivejdon through 5.0 Stored XSS via Private Short Messages |
| CVE-2026-107801 | 5.1 | — | banq | jivejdon | CWE-79 | Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type |
| CVE-2026-11936 | 4.9 | — | IBM | Security Verify Access | CWE-79 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-14521 | 4.9 | — | IBM | DataPower Gateway 10.6CD | CWE-918 | IBM DataPower Gateway affected by server-side request forgery |
| CVE-2026-107604 | 4.9 | — | Red Hat | Red Hat Build of Keycloak | CWE-200 | Keycloak-services: keycloak-services: view-clients role allows retrieval of a… |
| CVE-2026-44034 | 4.8 | — | OFFIS | DCMTK | CWE-125 | Heap out-of-bounds read in DCMTK RLE decodeFrame() |
| CVE-2026-44038 | 4.8 | — | OFFIS | DCMTK | CWE-125 | Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding |
| CVE-2026-107676 | 4.8 | — | FFmpeg | FFmpeg | CWE-908 | FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR10+ Metadata Seri… |
| CVE-2026-107397 | 4.4 | — | indico | indico | CWE-79 | Indico: Cross-Site-Scripting in minutes editor |
| CVE-2026-78388 | 4.3 | — | IBM | Security Verify Access | CWE-352 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-103072 | 4.3 | — | VillaTheme | VillaTheme Core | CWE-862 | WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability |
| CVE-2026-105891 | 4.3 | — | Liquid Web / StellarWP | Event Tickets | CWE-862 | WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability |
| CVE-2026-107395 | 4.3 | — | indico | indico | CWE-862 | Indico: Missing access check in legacy session export API |
| CVE-2026-107586 | 4.3 | — | Progressive Robot Ltd | hMailServer | CWE-770 | Allocation of Resources Without Limits or Throttling in hMailServer |
| CVE-2026-107623 | 4.3 | — | Red Hat | Red Hat Build of Keycloak | CWE-862 | Keycloak-services: keycloak-services: oidc dcr read-modify-write silently dis… |
| CVE-2026-107361 | 4.2 | — | CISA | Malcolm | CWE-288 | Authentication Bypass Using an Alternate Path or Channel in Malcolm |
| CVE-2026-107719 | 4.2 | — | nearform | fast-jwt | CWE-613 | fast-jwt: Verifier cache accepts expired JWTs without iat. |
| CVE-2026-12091 | 3.7 | — | IBM | Security Verify Access | CWE-125 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-107288 | 3.7 | — | pydantic | pydantic-ai | CWE-918 | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolve… |
| CVE-2026-107296 | 3.7 | — | mcollina | msgpack5 | CWE-471 | msgpack5: Decoding negative int64 values mutates the input buffer |
| CVE-2026-107727 | 3.7 | — | strawberry-graphql | strawberry | CWE-400 | Strawberry legacy graphql-ws retains naturally completed subscription slots |
| CVE-2026-89290 | 3.5 | — | İzometri IT Services Domestic and Foreign Trade Co. Ltd. | eimzamip | CWE-80 | HTML Injection in İzometri Informatics' eimzamip |
| CVE-2026-87980 | 3.1 | — | IBM | Guardium Data Protection | CWE-532 | Security vulnerability affects the UNIX S-TAP component as part of IBM Guardi… |
| CVE-2026-11939 | 2.7 | — | IBM | Security Verify Access | CWE-88 | Security vulnerabilities have been found in IBM Verify Identity Access and IB… |
| CVE-2026-107570 | 2.5 | — | mutt | mutt | CWE-823 | Use of Out-of-range Pointer Offset in mutt |
| CVE-2026-104634 | 2.3 | — | ScriptKittyOS | beam_mcp | CWE-704 | beam_mcp: JSON boolean and null tool arguments reach dispatch as strings |
| CVE-2026-107291 | 2.3 | — | pydantic | pydantic-ai | CWE-212 | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent… |
| CVE-2026-107293 | 2.3 | — | pydantic | pydantic-ai | CWE-212 | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redact… |
| CVE-2026-105823 | 2.1 | — | ImageMagick | ImageMagick | CWE-284 | ImageMagick before 7.1.2-31 Policy Bypass in CUT Encoder |
| CVE-2026-106432 | 2.0 | — | MongoDB | PHP Driver | CWE-681 | Heap buffer overflow via 32-bit string-length truncation in MongoDB PHP Driver |
| CVE-2026-56857 | await | — | Go standard library | os | — | Root.Mkdir(All) can follow junctions out of the root on Windows in os |
| CVE-2026-56866 | await | — | Go standard library | net/http | — | HTTP/1 client connection desynchronization after CONNECT rejection in net/http |
| CVE-2026-78659 | await | — | Go standard library | net/http | — | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78660 | await | — | Go standard library | net/http | — | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78663 | await | — | Go standard library | net/http | — | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-78667 | await | — | Go standard library | net/http | — | Lack of limit on size of parsed Range headers in net/http |
| CVE-2026-78669 | await | — | Go standard library | net/http | — | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-88647 | await | — | n/a | n/a | — | A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumve… |
| CVE-2026-88648 | await | — | n/a | n/a | — | Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controllin… |
| CVE-2026-94439 | await | — | Go standard library | net/http | — | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/… |
| CVE-2026-94440 | await | — | Go standard library | net/textproto | — | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart |
| CVE-2026-94444 | await | — | Go toolchain | cmd/go | — | Checksum bypass for golang.org/fips140 in cmd/go |
| CVE-2026-94447 | await | — | Go toolchain | cmd/go | — | Checksum database bypass for golang.org/toolchain in cmd/go |
| CVE-2026-94448 | await | — | Go standard library | html/template | — | Reset context tracking on consecutive template expressions in html/template |
| CVE-2026-95116 | await | — | n/a | n/a | — | An issue in libming through 0.4.8 allows a remote attacker to cause a denial … |
| CVE-2026-95125 | await | — | n/a | n/a | — | libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blo… |
| CVE-2026-97030 | await | — | Go standard library | html/template | — | Recognize yield as regexp preceder keyword in html/template |
| CVE-2026-97031 | await | — | Go standard library | crypto/tls | — | Reject malformed ECH outer extension references in crypto/tls |
| CVE-2026-97032 | await | — | Go standard library | net/http | — | HTTP/2 server crash due to HPACK encoder race in net/http |
