boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Thursday, October 15, 2026 · all times UTC← 2026-10-14 · archive

Security Box Score — October 15, 2026 — page 2

Edition of October 15, 2026, continued — page 2 of 2. Back to page 1

Transactions (continued)

ENRICHED — CVE-2018-12224 (Intel Corporation Intel(R) Graphics Driver for Windows). Received CVSS 3.3 and CPE data from NVD.

ENRICHED — CVE-2018-14720. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-14721. Received CVSS 10.0 and CPE data from NVD.

ENRICHED — CVE-2018-17828. Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-18089 (Intel Corporation Intel(R) Graphics Driver for Windows). Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-18090 (Intel Corporation Intel(R) Graphics Driver for Windows). Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-18091 (Intel Corporation Intel(R) Graphics Driver for Windows). Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-18700. Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-19139. Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-19360. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-19361. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-19362. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2018-19416. Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2018-19517. Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2018-19539. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-19540. Received CVSS 8.8 and CPE data from NVD.

ENRICHED — CVE-2018-19541. Received CVSS 8.8 and CPE data from NVD.

ENRICHED — CVE-2018-19542. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-19543. Received CVSS 7.8 and CPE data from NVD.

ENRICHED — CVE-2018-19857. Received CVSS 9.1 and CPE data from NVD.

ENRICHED — CVE-2018-19876. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2018-20406. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2018-20786. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2018-2811 (Oracle Corporation Java). Received CVSS 7.7 and CPE data from NVD.

ENRICHED — CVE-2018-7489. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2023-35827. Received CVSS 7.0 and CPE data from NVD.

ENRICHED — CVE-2023-36660. Received CVSS 9.8 and CPE data from NVD.

ENRICHED — CVE-2023-39128. Received CVSS 5.5 and CPE data from NVD.

ENRICHED — CVE-2023-39615. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2023-45322. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2023-45863. Received CVSS 6.4 and CPE data from NVD.

ENRICHED — CVE-2023-45871. Received CVSS 7.5 and CPE data from NVD.

ENRICHED — CVE-2023-46862. Received CVSS 4.7 and CPE data from NVD.

ENRICHED — CVE-2023-50495. Received CVSS 6.5 and CPE data from NVD.

ENRICHED — CVE-2026-103500 (Mozilla Thunderbird). Received CVSS 6.1 and CPE data from NVD.

Results (continued, ranked) — ranks 401–557 of 557
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-1110966.7—JetBrainsTeamCityCWE-79In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the cl…
CVE-2026-798306.6—Hewlett Packard EnterpriseHPE NonStop Kernel Level Thread Model LibCWE-121HPE NonStop Kernel Level Thread Model Lib - Stack buffer overflow vulnerability
CVE-2026-798316.6—Hewlett Packard EnterpriseHPE NonStop Posix User ThreadsCWE-122HPE NonStop Posix User Threads - Heap buffer overflow vulnerability
CVE-2026-466916.5—espocrmespocrmCWE-862EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users
CVE-2026-466946.5—espocrmespocrmCWE-862EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes
CVE-2026-546836.5—nl-portalnl-portal-backend-librariesCWE-285NL Portal Backend Libraries: Document contents remained downloadable by any l…
CVE-2026-558716.5—mayerbalintdevGYM-OneCWE-89GYM One: Improper Neutralization of Special Elements used in an SQL Command (…
CVE-2026-623226.5—python-social-authsocial-coreCWE-352Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth s…
CVE-2026-774606.5—espocrmespocrmCWE-639EspoCRM: Mass email template renderer leaks restricted record fields
CVE-2026-788516.5—n/an/aCWE-22Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a re…
CVE-2026-798436.5—Hewlett Packard EnterpriseHPE NonStop SQL/MX EXECWE-125HPE NonStop SQL/MX EXE - out-of-bounds read vulnerability
CVE-2026-1023896.5—WPMU DEVBroken Link CheckerCWE-94WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerab…
CVE-2026-1042666.5—tinytagtinytagCWE-835tinytag: Infinite loop when parsing certain M4A files containing invalid atoms
CVE-2026-1058826.5—ThemeGrillUser RegistrationCWE-79WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vuln…
CVE-2026-1061636.5—Progress SoftwareKendo UI for jQueryCWE-80Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
CVE-2026-1066046.5—YITHYITH WooCommerce CompareCWE-79WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (X…
CVE-2026-1081756.5—PluginUs.NetMDTFCWE-79WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1084346.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-1084356.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-822Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-1084366.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-1084386.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-416Microsoft Office Word Information Disclosure Vulnerability
CVE-2026-1084536.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office PowerPoint Information Disclosure Vulnerability
CVE-2026-1084546.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-126Microsoft Office PowerPoint Information Disclosure Vulnerability
CVE-2026-1084556.5—MicrosoftMicrosoft 365 Apps for EnterpriseCWE-125Microsoft Office PowerPoint Information Disclosure Vulnerability
CVE-2026-1098936.5—Brainstorm ForcePresto PlayerCWE-79WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerab…
CVE-2026-1103616.5—ClikITInfinite UploadsCWE-201WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerab…
CVE-2026-1103756.5—WP ChillDownload MonitorCWE-79WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulne…
CVE-2026-1107266.5—Eclipse FoundationEclipse Connected Services PlatformCWE-348In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, …
CVE-2026-1108906.5—CrocoblockJetSmartFiltersCWE-79WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulner…
CVE-2026-1110926.5—JetBrainsYouTrackCWE-862In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16…
CVE-2026-1112526.5—The OpenNMS GroupMeridianCWE-400OpenNMS denial of service via XML entity expansion
CVE-2026-798366.4—Hewlett Packard EnterpriseHPE NonStop SQL/MX Run-Time StatisticsCWE-20HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulne…
CVE-2026-634306.3—rust-ammoniaammoniaCWE-79ammonia: mXSS in ammonia via MathML `annotation-xml` encoding strip
CVE-2026-946216.3—aliasvaultaliasvaultCWE-367AliasVault: Server-Side Request Forgery via DNS rebinding in Favicon Extraction
CVE-2026-1103816.3—NSquaredSimply Schedule AppointmentsCWE-639WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct …
CVE-2026-1111716.3—ethereumweb3.pyCWE-918Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass
CVE-2026-1113326.3—AtalayaLabsOxiCloudCWE-863OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie
CVE-2026-571836.1—ErudikascooldCWE-287Scoold: Forged JWT Accepted as Admin API Token Allowing Unauthorized Access t…
CVE-2026-1067016.1—n/an/a—ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the c…
CVE-2026-1113686.1—classroomioClassroomIOCWE-639ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete…
CVE-2026-167556.0—LenovoSmart Camera C33CWE-1393A potential vulnerability was reported in Lenovo Smart Camera C33, distribute…
CVE-2026-755056.0—espocrmespocrmCWE-862EspoCRM: Access control bypass in Mass Update letting regular user with Mass …
CVE-2026-1081266.0—Temporal Technologies, Inc.temporal-proxyCWE-639temporal-proxy payload decryption is not bound to the request namespace
CVE-2026-1111726.0—stalniy@casl/abilityCWE-1321@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath
CVE-2026-167545.9—LenovoSmart Camera C33CWE-295A potential improper certificate validation vulnerability was reported in Len…
CVE-2026-583935.9—opnsensecoreCWE-22OPNsense: OpenVPN Client Specific Override common_name allows path traversal …
CVE-2026-870295.9—undiciundiciCWE-248undici vulnerable to Denial of Service via unhandled exception in the decompr…
CVE-2026-1026315.9—CanonicalauthdCWE-287authd: Account takeover via username fallback in identity matching after IdP …
CVE-2026-1098415.9—undiciundiciCWE-178undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm…
CVE-2026-1099245.9—undiciundiciCWE-770undici vulnerable to Denial of Service via unbounded memory in the EventSourc…
CVE-2026-1099325.9—undiciundiciCWE-400undici WebSocket client vulnerable to Denial of Service via unbounded automat…
CVE-2026-798415.8—Hewlett Packard EnterpriseHPE NonStop RDMA SERVICES NSKCWE-787HPE NonStop RDMA SERVICES NSK - Out-of-bounds memory write vulnerability
CVE-2026-1027405.8—AsyncHttpClientasync-http-clientCWE-61AsyncHttpClient: Resumable download index store is created world-readable and…
CVE-2026-554805.7—OpenPrintingcupsCWE-59CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLO…
CVE-2026-575685.7—LycheeOrgLycheeCWE-79Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descript…
CVE-2026-1111415.7—gdraheimzziplibCWE-125zziplib through 0.13.80 Out-of-Bounds Read via __zzip_parse_root_directory ZI…
CVE-2026-631305.5—espocrmespocrmCWE-22EspoCRM: Admin path traversal in LabelManager (Custom Label saving) allows ar…
CVE-2026-951805.5—n/an/aCWE-284An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local …
CVE-2026-81455.4—wpxpoWholesaleX – All-in-One B2B Solution with Wholesale PricingCWE-269WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'proce…
CVE-2026-551545.4—espocrmespocrmCWE-1236EspoCRM: CSV/Formula Injection sanitizer bypass via leading whitespace/contro…
CVE-2026-558405.4—ErudikascooldCWE-601Scoold: Open Redirect in getBackToUrl() allows phishing via domain-prefix sta…
CVE-2026-558425.4—ErudikascooldCWE-346Scoold: CORS wildcard origin with credentials enabled allows cross-origin aut…
CVE-2026-583915.4—opnsensecoreCWE-79OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
CVE-2026-583925.4—opnsensecoreCWE-79OPNsense: Stored XSS in Services: NTP GPS
CVE-2026-927775.4—LenovoIdea Tab Pro (TB373FU)CWE-1394A potential vulnerability was reported in some Lenovo Tablets that could allo…
CVE-2026-1030835.4—ELEXtensionsELEX WooCommerce Advanced Bulk Edit Products, Prices & AttributesCWE-639WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes p…
CVE-2026-1061475.4—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
CVE-2026-1061485.4—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI …
CVE-2026-1061495.4—Progress SoftwareKendo UI for jQueryCWE-80Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
CVE-2026-1061505.4—Progress SoftwareKendo UI for jQueryCWE-79Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
CVE-2026-1061515.4—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
CVE-2026-1061535.4—Progress SoftwareKendo UI for jQueryCWE-79Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
CVE-2026-1061605.4—Progress SoftwareKendo UI for jQueryCWE-1321Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
CVE-2026-1061615.4—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
CVE-2026-1067065.4—n/an/a—XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (…
CVE-2026-1067075.4—n/an/aCWE-79XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnera…
CVE-2026-1091315.4—Red HatRed Hat Ansible Automation Platform 2CWE-79Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub co…
CVE-2026-1098975.4—WP ChillStrong TestimonialsCWE-862WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulner…
CVE-2026-1108915.4—WordLift SrlWordLiftCWE-862WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability
CVE-2026-554145.3—nl-portalnl-portal-backend-librariesCWE-862NL Portal Backend Libraries: Unauthenticated form resolver forwards the privi…
CVE-2026-617025.3—OpenPrintingcupsCWE-22OpenPrinting CUPS: root-side banner file disclosure
CVE-2026-927075.3—MessagePack-CSharpMessagePack-CSharpCWE-1325MessagePack: Nested arrays can blow past buffer length limits
CVE-2026-964495.3—WPExpertsWP EasyPayCWE-862WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability
CVE-2026-1003475.3—getkinkin-openapiCWE-20kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via …
CVE-2026-1003485.3—getkinkin-openapiCWE-476kin-openapi spec loader panics on a self-referential additionalProperties $re…
CVE-2026-1003505.3—getkinkin-openapiCWE-400kin-openapi deepObject query decoding repeatedly compiles an invariant regula…
CVE-2026-1033505.3—Magepeople inc.Booking and Rental ManagerCWE-1284WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Ty…
CVE-2026-1041985.3—ZoneMinderzoneminderCWE-287ZoneMinder failed token handling bypasses web authentication
CVE-2026-1084995.3—WebberZoneKnowledge BaseCWE-862WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability
CVE-2026-1096895.3—WP SunshineSunshine Photo CartCWE-862WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnera…
CVE-2026-1103605.3—WPdreamsAjax Search LiteCWE-862WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerabi…
CVE-2026-1103625.3—Planet studioPlanetStudio Payment GatewayCWE-862WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Contro…
CVE-2026-1103645.3—WP DeskFlexible Quantity – Measurement Price Calculator for WooCommerceCWE-862WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce pl…
CVE-2026-1103675.3—WPExpertsAPIExperts Square for WooCommerceCWE-862WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access C…
CVE-2026-1103785.3—WP E-SignatureNinja Forms Signature Contract Add-OnCWE-862WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Acce…
CVE-2026-1113215.3—TaskingAITaskingAICWE-918TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions
CVE-2026-1113315.3—DokployDokployCWE-639Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC …
CVE-2026-1113435.3—pig-meshpigCWE-862pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}
CVE-2026-1113445.3—apitableapitableCWE-639APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/desc…
CVE-2026-1113455.3—poloneltrudeskCWE-639Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversa…
CVE-2026-1113465.3—easysoftzentaopmsCWE-639ZenTao PMS through 22.6 Authorization Bypass via action::editComment
CVE-2026-1113485.3—likeshoplikeshopCWE-639Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints
CVE-2026-1113535.3—Peppermint-LabpeppermintCWE-862Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachme…
CVE-2026-1113555.3—zhontaiAdmin.CoreCWE-639zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organizat…
CVE-2026-1113585.3—mettlesendportal-coreCWE-639SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via S…
CVE-2026-583945.2—opnsensecoreCWE-79OPNsense: Stored XSS in Administration Settings via Certificate Description
CVE-2026-175255.1—ABBMy Control SystemCWE-459My Control System 26.5 – Disk space exhaustion due to incorrect temporary fil…
CVE-2026-976675.1—SonatypeNexus Repository 3CWE-79Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
CVE-2026-1108785.1—aureuserpaureuserpCWE-79Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
CVE-2026-1111685.1—abhinavxdlibredeskCWE-79LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
CVE-2026-1112275.1—NetgatepfSense CECWE-93Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php
CVE-2026-1112285.1—NetgatepfSense CECWE-93Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_ad…
CVE-2026-1112845.1—WebkulAureus ERPCWE-79Aureus ERP through 1.6.0 Stored XSS via Time Off Holiday Action Modal
CVE-2026-788505.0—n/an/aCWE-918An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive info…
CVE-2026-1109244.8—Red HatRed Hat Enterprise Linux 10CWE-459Openssh: openssh: gssapi delegated credentials can be stored after a failed a…
CVE-2026-1112324.8—NetgatepfSense CECWE-79Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
CVE-2026-1061574.7—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery
CVE-2026-1061584.7—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
CVE-2026-1061594.7—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery
CVE-2026-1061624.7—Progress SoftwareKendo UI for jQueryCWE-80Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
CVE-2026-1040244.6—PeaZipPeaZipCWE-184Incomplete dangerous-extension list in PeaZip object open allows execution of…
CVE-2026-467084.3—espocrmespocrmCWE-639EspoCRM: Target list Opt-Out actions allows opting out record without access …
CVE-2026-558754.3—HeliumEduplatformCWE-918Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe In…
CVE-2026-583954.3—opnsensecoreCWE-643OPNsense: XPath injection in MVC safe-delete
CVE-2026-599944.3—espocrmespocrmCWE-79EspoCRM: Pre-authentication stored HTML injection in stream notification emai…
CVE-2026-1103714.3—WP ChillStrong TestimonialsCWE-862WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulner…
CVE-2026-1103744.3—Hamid AliniaLogin with phone numberCWE-862WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vu…
CVE-2026-1108884.3—Meow AppsAI EngineCWE-862WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability
CVE-2026-1109174.3—GoogleChromeCWE-119Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a re…
CVE-2026-1109184.3—GoogleChromeCWE-119Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a r…
CVE-2026-1109274.3—Red HatRed Hat Hardened ImagesCWE-770Openssh: openssh: a compressed payload can expand past the maximum packet size
CVE-2026-551843.5—espocrmespocrmCWE-79EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
CVE-2026-558763.5—HeliumEduplatformCWE-79Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can…
CVE-2026-554533.3—OpenPrintingcupsCWE-74CUPS ipp backend status-line injection can update queue PPD and lead to condi…
CVE-2026-798352.8—Hewlett Packard EnterpriseHPE Nonstop KMS ServerCWE-20HPE Nonstop KMS Server - Buffer overflow vulnerability
CVE-2026-535752.7—espocrmespocrmCWE-79EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by…
CVE-2026-554672.5—OpenPrintingcupsCWE-93CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer …
CVE-2026-575692.3—LycheeOrgLycheeCWE-367Lychee: Distinct post-fix SSRF variant in Photo::fromUrl due to missing IP pi…
CVE-2026-616102.3—LycheeOrgLycheeCWE-284Lychee: unauthenticated photo starring reveals existence of private photos wh…
CVE-2026-1111692.3—suitenumeriquedocsCWE-639La Suite Docs through 6.0.0 Authorization Bypass via Comment Thread Creation
CVE-2026-1112252.3—NetgatepfSense CECWE-78Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn…
CVE-2026-1112332.3—NetgatepfSense CECWE-79Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
CVE-2026-1113502.3—papermarkPapermarkCWE-862Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API
CVE-2026-1113512.3—metasfreshmetasfreshCWE-639metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API
CVE-2026-1113542.3—crmebcrmeb_javaCWE-639crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refun…
CVE-2026-36436await—n/an/a—An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in …
CVE-2026-52167await—n/an/a—A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 all…
CVE-2026-88753await—n/an/a—A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_meta…
CVE-2026-92228await—Apache Software FoundationApache Airflow Keycloak providerCWE-732Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants eve…
CVE-2026-93649await—Eclipse FoundationAdoptium TemurinCWE-494In the Eclipse Adoptium website (adoptium.net), in every deployment built fro…
CVE-2026-94134await—Apache Software FoundationApache Airflow SSH providerCWE-322Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables …
CVE-2026-94135await—Apache Software FoundationApache Airflow SFTP providerCWE-322Apache Airflow SFTP provider: Async SFTP hook disables host-key verification …
CVE-2026-96806await—Apache Software FoundationApache Airflow Keycloak providerCWE-613Apache Airflow Keycloak provider: Keycloak auth manager: logout does not inva…
CVE-2026-98432await—LinuxLinux—ipv4: free inet_opt and ireq_opt after an RCU grace period
CVE-2026-104586await—n/an/a—AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Inj…
CVE-2026-110724await—Eclipse FoundationEclipse Connected Services PlatformCWE-269In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, …
CVE-2026-110916await—GoogleChromeCWE-20Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 …