| Bug | Description | Note |
|---|
| CVE-2015-20130 | Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected c ... | check |
| CVE-2016-1584 | In all versions of Unity8 a running but not active application on a la ... | check proper tracking update |
| CVE-2018-25305 | librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that all ... | check |
| CVE-2018-25306 | PDFunite 0.41.0 contains a buffer overflow vulnerability that allows l ... | check |
| CVE-2019-25485 | R 3.4.4 on Windows x64 contains a buffer overflow vulnerability in the ... | check |
| CVE-2019-25683 | FileZilla 3.40.0 contains a denial of service vulnerability in the loc ... | check |
| CVE-2022-4996 | A flaw has been found in mruby 3.1.0. Affected is the function udiv of ... | check |
| CVE-2022-23538 | github.com/sylabs/scs-library-client is the Go client for the Singular ... | check details, might as well affect golang-github-apptainer-container-library-client |
| CVE-2022-50942 | Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerab ... | check status upstream |
| CVE-2023-26044 | react/http is an event-driven, streaming HTTP client and server implem ... | check, is embedded inicinga-php-thirdparty, icingaweb2-module-reactbundle possibly affected |
| CVE-2023-47268 | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6. ... | check |
| CVE-2023-49316 | In Math/BinaryField.php in phpseclib 3 before 3.0.34, excessively larg ... | check if affecting ldap-account-manager or unused path |
| CVE-2023-50251 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50252 | php-svg-lib is an SVG file parsing / rendering library. Prior to versi ... | check, other packages are embedding the library: civicrm, icinga-php-thirdparty and icingaweb2 to be checked |
| CVE-2023-50262 | Dompdf is an HTML to PDF converter for PHP. When parsing SVG images Do ... | check sources embedding php-dompdf if affected |
| CVE-2024-22420 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-22421 | JupyterLab is an extensible environment for interactive and reproducib ... | check completeness, src:jupyter-notebook? |
| CVE-2024-36309 | Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a ... | check |
| CVE-2024-54192 | An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial ... | check |
| CVE-2025-0008 | Insufficient verification of data authenticity may allow a local attac ... | check |
| CVE-2025-0027 | Improper access control in AMD Secure Encrypted Virtualization (SEV) f ... | check |
| CVE-2025-4382 | A flaw was found in systems utilizing LUKS-encrypted disks with GRUB c ... | double check if vulnerability only considered present after grub_is_cli_disabled is introduced |
| CVE-2025-6499 | A vulnerability classified as problematic was found in vstakhov libucl ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-8671 | A mismatch caused by client-triggered server-sent stream resets betwee ... | check, some projects will assign own CVEs and should then be covered under that specific CVE instead |
| CVE-2025-8941 | A flaw was found in linux-pam. The pam_namespace module may improperly ... | check likely RedHat specific incomplete fix for CVE-2025-6020, but asked to pinpoint incomplete fixes |
| CVE-2025-11010 | A vulnerability has been found in vstakhov libucl up to 0.9.2. Affecte ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2025-11147 | Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1. The vuln ... | clarifying with reporter and Eduard Bloch on the issue. |
| CVE-2025-14575 | An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS b ... | check |
| CVE-2025-15569 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The im ... | check |
| CVE-2025-29940 | Unverified ownership in Secure Encrypted Virtualization (SEV) firmware ... | check |
| CVE-2025-29941 | Incorrect usage of seeds in pseudo-random number generator in the Secu ... | check |
| CVE-2025-33221 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2025-48504 | Operation on a resource after expiration or release in the Secure Encr ... | check |
| CVE-2025-49602 | An issue was discovered in Keyfactor EJBCA 9. When an administrator is ... | check |
| CVE-2025-52535 | Improper resource reuse in the AMD Secure Encrypted Virtualization (SE ... | check |
| CVE-2025-52537 | Improper access control within the AMD Secure Encrypted Virtualization ... | check |
| CVE-2025-54503 | Improper handling of overlap between protected memory ranges in the Se ... | check |
| CVE-2025-54504 | Insufficient Granularity of Access Control in AMD Secure Encrypted Vir ... | check |
| CVE-2025-54506 | A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV ... | check |
| CVE-2025-54508 | Improper validation of Reverse Map Table (RMP) entries in the Secure E ... | check |
| CVE-2025-58064 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2025-61261 | A reflected cross-site scripting (XSS) vulnerability in CKeditor v46.1 ... | check |
| CVE-2025-61982 | An arbitrary code execution vulnerability exists in the Code Stream di ... | check upstream status |
| CVE-2025-62620 | Improper validation of unsafe equivalence in input could allow an atta ... | check |
| CVE-2025-62621 | Expected behavior violation in AMD Secure Encrypted Virtualization (SE ... | check |
| CVE-2025-66578 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2025-67108 | eProsima Fast-DDS v3.3 was discovered to contain improper validation f ... | check https://gist.github.com/lkloliver/81b5d5a8328d712dbfd497bf11dbe913, unclear if reported upstream |
| CVE-2025-69534 | Python-Markdown version 3.8 contain a vulnerability where malformed HT ... | Asking whether it really needs a backport: https://bugs.debian.org/1131896 |
| CVE-2025-69720 | The infocmp command-line tool in ncurses before 6.5-20251213 has a sta ... | check upstream status |
| CVE-2025-69969 | A lack of authentication and authorization mechanisms in the Bluetooth ... | check |
| CVE-2025-70887 | An issue in ralphje Signify before v.0.9.2 allows a remote attacker to ... | check |
| CVE-2025-71458 | FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 an ... | check |
| CVE-2026-0003 | Use of a per-part static key in the ASP Bootloader could allow an atta ... | check |
| CVE-2026-0435 | Operation on a resource after expiration or release in the AMD Secure ... | check |
| CVE-2026-0454 | An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV ... | check |
| CVE-2026-0470 | Null pointer dereference in AMD Embedded SPI Flash driver could allow ... | check |
| CVE-2026-0480 | Missing Authentication for Critical Function in AMD Secure Encrypted V ... | check |
| CVE-2026-0708 | A flaw was found in libucl. A remote attacker could exploit this by pr ... | check if impacts security wise rspamd, which embeds libucl and uses it a compile time |
| CVE-2026-1703 | When pip is installing and extracting a maliciously crafted wheel arch ... | check as well pipenv |
| CVE-2026-4833 | A weakness has been identified in Orc discount up to 3.0.1.2. This iss ... | check libtext-markdown-discount-perl, ruby-rdiscount, cantor, embedding discount; check if security impact present |
| CVE-2026-5422 | A path traversal vulnerability exists in jupyter-server version 2.17.0 ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-35397 |
| CVE-2026-6657 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allow ... | CNA contacted responsible for this CVE entry as this seems to be a duplicate of CVE-2026-40110 |
| CVE-2026-7790 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (c ... | check if embedded copy in rabbitmq-server is problematic |
| CVE-2026-8851 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability ... | check correctness |
| CVE-2026-8863 | Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to Secu ... | check |
| CVE-2026-10051 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the se ... | check, jetty9 might not be affected as not explicitly mentioned in the GhSA and still supported |
| CVE-2026-10528 | A security flaw has been discovered in Orthanc DICOM Server up to 1.12 ... | check, uderlying issue in src:dcmtk and should the CVE be associated with it? Cf. #1138713 |
| CVE-2026-10537 | A misconfiguration issue in the affected service in Control-M/Enterpri ... | check |
| CVE-2026-11315 | A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_int ... | check |
| CVE-2026-11316 | A out-of-bounds write vulnerability exists in the dr_wav drwav__read_c ... | check |
| CVE-2026-11749 | A vulnerability has been identified in armeria-saml prior to 1.41.1, w ... | check |
| CVE-2026-11753 | A vulnerability has been identified in armeria-saml versions prior to ... | check |
| CVE-2026-12708 | Summary Cloudflare tokio-quiche was found to contain an uncontrolled ... | check |
| CVE-2026-14968 | EDK2 contains vulnerabilities in BIOS where skilled and privileged use ... | check |
| CVE-2026-15713 | A vulnerability was found in libsoup's HTTP/2 protocol implementation. ... | While the above issue references this CVE, it doesn't match the CVE description at all, check with CNA (Red Hat) |
| CVE-2026-15779 | A flaw was found in samba's pam_winbind. When mkhomedir is enabled, pa ... | check if Red Hat specific |
| CVE-2026-16478 | Permissive list of allowed inputs vulnerability in T\xdcB\u0130TAK B\u ... | check |
| CVE-2026-18448 | EDK2 contains a vulnerability in BIOS where a privileged attacker may ... | check |
| CVE-2026-18767 | A local low privileged attacker or process can access I/O ports via Tc ... | check |
| CVE-2026-18768 | A local low privileged attacker can access arbitrary physical memory o ... | check |
| CVE-2026-18769 | A local low privileged attacker can move arbitrary physical memory con ... | check |
| CVE-2026-19201 | An uncontrolled recursion vulnerability in the Windows SIPA event log ... | check, GHSA not yet public, maybe Windows specific |
| CVE-2026-20703 | Protection mechanism failure for some BigDL before version 2.4.0 withi ... | check |
| CVE-2026-20756 | Incorrect default permissions for some Intel(R) Graphics Driver softwa ... | check |
| CVE-2026-20798 | Uncontrolled search path for some Intel(R) Graphics Driver software in ... | check |
| CVE-2026-20880 | Incorrect default permissions for some Intel(R) Graphics Driver softwa ... | check |
| CVE-2026-21407 | Deadlock for some Intel(R) Arc(TM) B-series graphics cards within Ring ... | check |
| CVE-2026-22739 | Vulnerability in Spring Cloud when substituting the profile parameter ... | check |
| CVE-2026-24182 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24187 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24190 | NVIDIA Display Driver for Windows and Linux contains a vulnerability i ... | check |
| CVE-2026-24192 | NVIDIA Display Driver for Linux contains a vulnerability where an atta ... | check |
| CVE-2026-24193 | NVIDIA Display Driver for Windows and Linux contains a vulnerability w ... | check |
| CVE-2026-24194 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-24195 | NVIDIA Display Driver for Linux contains a vulnerability in UVM, where ... | check |
| CVE-2026-24196 | NVIDIA Display Driver for Linux contains a vulnerability where a user ... | check |
| CVE-2026-24197 | NVIDIA Display Driver for Linux contains a vulnerability in the Multi- ... | check |
| CVE-2026-24198 | NVIDIA GPU Display Driver for Linux contains a vulnerability where an ... | check |
| CVE-2026-24199 | NVIDIA Display Driver for Linux contains a vulnerability in a kernel m ... | check |
| CVE-2026-26052 | Insecure inherited permissions for some Intel(R) Graphics Driver softw ... | check |
| CVE-2026-27970 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-28247 | Improper Access Control Applied to Mirrored or Aliased Memory Regions ... | check |
| CVE-2026-28248 | Improper enforcement of behavioral workflow in AMD Secure Encrypted Vi ... | check |
| CVE-2026-28249 | Improper preservation of consistency between independent representatio ... | check |
| CVE-2026-28343 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-28702 | Incorrect default permissions for the Intel(R) VTune(TM) Profiler soft ... | check |
| CVE-2026-28730 | Null pointer dereference for some Hyperscan before version v5.4.2.1 wi ... | check |
| CVE-2026-28743 | Out-of-bounds write for the Intel(R) VTune(TM) Profiler software befor ... | check |
| CVE-2026-28746 | Out-of-bounds read in the AuthenticateComponent for the Intel(R) Slim ... | check |
| CVE-2026-28765 | Improper input validation for the Intel(R) VTune(TM) Profiler software ... | check |
| CVE-2026-29022 | dr_libs dr_wav.h version 0.14.4 and earlier (fixed in commit 8a7258c) ... | qtads, dosbox-x, roc-toolkit, octave-ltfat, faudio bundle a copy, check security impact |
| CVE-2026-29036 | cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved na ... | check, report upstream status |
| CVE-2026-30478 | A Dynamic-link Library Injection vulnerability in GatewayGeo MapServer ... | check |
| CVE-2026-30479 | A Dynamic-link Library Injection vulnerability in OSGeo Project MapSer ... | check |
| CVE-2026-31053 | A double free vulnerability exists in librz/bin/format/le/le.c in the ... | check |
| CVE-2026-32313 | xmlseclibs is a library written in PHP for working with XML Encryption ... | check |
| CVE-2026-32600 | xml-security is a library that implements XML signatures and encryptio ... | check |
| CVE-2026-32635 | Angular is a development platform for building mobile and desktop web ... | check status for older versions |
| CVE-2026-32667 | Out-of-bounds write for the Intel(R) VTune(TM) Profiler software withi ... | check |
| CVE-2026-32670 | Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Pr ... | check |
| CVE-2026-32672 | Null pointer dereference for the Intel(R) NPU Drivers before version 3 ... | check |
| CVE-2026-33089 | Improper input validation for some Intel(R) CIP software within Ring 2 ... | check |
| CVE-2026-33094 | Out-of-bounds write for some Hyperscan before version v5.4.2.1 within ... | check |
| CVE-2026-33270 | Improper input validation for some Intel(R) Graphics Software within R ... | check |
| CVE-2026-33275 | Improper resource shutdown or release for some Intel(R) PROSet/Wireles ... | check |
| CVE-2026-33279 | Out-of-bounds write for the Intel(R) VTune(TM) Profiler software befor ... | check |
| CVE-2026-33563 | Exposure of sensitive information to an unauthorized actor for some In ... | check |
| CVE-2026-33567 | Improper input validation for the Intel(R) VTune(TM) Profiler software ... | check |
| CVE-2026-33571 | Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before ... | check |
| CVE-2026-34016 | Time-of-check time-of-use race condition for the Intel(R) VTune(TM) Pr ... | check |
| CVE-2026-34017 | Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 ... | check |
| CVE-2026-34240 | JOSE is a Javascript Object Signing and Encryption (JOSE) library. Pri ... | check |
| CVE-2026-34489 | Untrusted pointer dereference for some Hyperscan before version v5.4.2 ... | check |
| CVE-2026-35500 | Stack-based buffer overflow in the UEFI firmware for the Intel(R) Slim ... | check |
| CVE-2026-35683 | Out-of-bounds write for some Intel(R) Multi-Buffer Crypto for IPSec wi ... | check |
| CVE-2026-36499 | A missing upper-bound check in the udpif_set_threads() function of Ope ... | check, unclear status/validity |
| CVE-2026-39178 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39179 | A SQL injection vulnerability in SOGo before 5.12.7 allows authenticat ... | CVE-2026-39178 and CVE-2026-39179 are duplicates of CVE-2026-46445 and CVE-2026-46446, CNA contacted |
| CVE-2026-39456 | Improper input validation for some Media Transcode Accelerator before ... | check |
| CVE-2026-39860 | Nix is a package manager for Linux and other Unix systems. A bug in th ... | check, potentially affecting guix if same issue in backporting fix for CVE-2024-2729 |
| CVE-2026-40033 | FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in ... | unclear fixing commit references, incorrect reference in CVE entry? |
| CVE-2026-40064 | Improper input validation for some Intel(R) oneAPI CLI Tool software w ... | check |
| CVE-2026-40065 | Improper input validation for some Intel(R) Neural Compressor software ... | check |
| CVE-2026-40216 | Out-of-bounds read for some Hyperscan before version v5.4.2.1 within R ... | check |
| CVE-2026-40424 | Out-of-bounds read for some Hyperscan before version v5.4.2.1 within R ... | check |
| CVE-2026-40426 | Integer underflow (wrap or wraparound) for the Intel(R) NPU Driver sof ... | check |
| CVE-2026-40427 | Use after free for some Intel(R) QuickAssist Technology Driver for Win ... | check |
| CVE-2026-40433 | Heap-based buffer overflow for some Intel(R) PROSet Wireless Wi-Fi Sof ... | check |
| CVE-2026-40626 | Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) softw ... | check |
| CVE-2026-40668 | Authentication bypass by spoofing in AMD Secure Encrypted Virtualizati ... | check |
| CVE-2026-40669 | An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmw ... | check |
| CVE-2026-40670 | Improper check for unusual or exceptional conditions in AMD Secure Enc ... | check |
| CVE-2026-40693 | Improper input validation for some Intel(R) TDX Workload Attestation s ... | check |
| CVE-2026-40694 | Out-of-bounds write for some Hyperscan before version v5.4.2.1 within ... | check |
| CVE-2026-40695 | Null pointer dereference for some Intel(R) Wireless Bluetooth(R) withi ... | check |
| CVE-2026-40697 | Use after free for some Intel(R) Wireless Software for Windows within ... | check |
| CVE-2026-40704 | Protection mechanism failure for some Intel Neural Compressor software ... | check |
| CVE-2026-40705 | Improper resource locking for the Intel(R) NPU Drivers before version ... | check |
| CVE-2026-40853 | ACross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGF ... | check |
| CVE-2026-41214 | Improper input validation for some Intel(R) Neural Compressor software ... | check |
| CVE-2026-41221 | Integer overflow in the UEFI firmware for the Intel(R) Slim Bootloader ... | check |
| CVE-2026-41224 | Out-of-bounds write in the UEFI firmware for the Intel(R) Slim Bootloa ... | check |
| CVE-2026-41889 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, ... | check the other golang-github-jackc-pgx* sources |
| CVE-2026-42056 | Stack-based buffer overflow for some Intel(R) Wireless Bluetooth(R) wi ... | check |
| CVE-2026-42067 | Improper certificate validation for some Intel(R) TDX Workload Attesta ... | check |
| CVE-2026-42199 | Grid is a data structure grid for rust. From version 0.17.0 to before ... | check |
| CVE-2026-42308 | Pillow is a Python imaging library. Prior to version 12.2.0, if a font ... | research fixing commit(s), maybe https://github.com/python-pillow/Pillow/pull/9518/changes |
| CVE-2026-42503 | gopls by default communicates via pipe. However, -port and -listen fla ... | check impact on golang-golang-x-tools |
| CVE-2026-42917 | Deserialization of untrusted data for some Intel(R) Neural Compressor ... | check |
| CVE-2026-42956 | Out-of-bounds write for some Intel(R) Wireless Bluetooth(R) within Rin ... | check |
| CVE-2026-42966 | Uncaught exception for some Intel(R) Neural Compressor software before ... | check |
| CVE-2026-43603 | A NULL pointer dereference in the Linux GPU driver could potentially l ... | check |
| CVE-2026-43627 | llama.cpp builds b1283 through b9058 contain an integer overflow vulne ... | check |
| CVE-2026-43628 | llama.cpp builds b3978 through b9058 contain an integer underflow and ... | check |
| CVE-2026-43629 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vu ... | check |
| CVE-2026-43631 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-43632 | llama.cpp builds b7492 through the latest b9060 contains a use-after-f ... | check |
| CVE-2026-44382 | Out-of-bounds read for some Intel(R) Wireless Bluetooth(R) within Ring ... | check |
| CVE-2026-44606 | Out-of-bounds write for some Intel(R) Intelligent Storage Acceleration ... | check |
| CVE-2026-44624 | Incorrect comparison in the Ext2 parser for the Intel(R) Slim Bootload ... | check |
| CVE-2026-44625 | Use after free for some Intel(R) Wireless Bluetooth(R) within Ring 0: ... | check |
| CVE-2026-44627 | Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neur ... | check |
| CVE-2026-44685 | Authentication bypass by spoofing in the MigTD rebinding protocol for ... | check |
| CVE-2026-44929 | Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphic ... | check |
| CVE-2026-44933 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot ... | check |
| CVE-2026-46632 | Uncontrolled search path for some Intel(R) Application Optimization Us ... | check |
| CVE-2026-46727 | An issue was discovered in Ruby 4 before 4.0.5. A race condition leadi ... | check |
| CVE-2026-48479 | Use of uninitialized or invalid state in AMD Graphics Driver could all ... | check |
| CVE-2026-49028 | Deserialization of untrusted data for some Intel(R) Neural Compressor ... | check |
| CVE-2026-49036 | Time-of-check time-of-use race condition in the MigTD shared memory fo ... | check |
| CVE-2026-49236 | Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphic ... | check |
| CVE-2026-50109 | Out-of-bounds write for some Intel(R) Performance Counter Monitor (Int ... | check |
| CVE-2026-50175 | Untrusted pointer dereference in the FirmwareWakingVector for the Inte ... | check |
| CVE-2026-50177 | Deserialization of untrusted data for some Intel(R) Neural Compressor ... | check |
| CVE-2026-50249 | Out-of-bounds read in the GenerationSetup for the Intel(R) Server Boar ... | check |
| CVE-2026-52899 | Deserialization of untrusted data for some BigDL software before versi ... | check |
| CVE-2026-55223 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0 ... | check if that is an issue with the packaged version |
| CVE-2026-55663 | mediasoup is a WebRTC video conferencing system. From version 3.20.0 u ... | check |
| CVE-2026-55709 | Loop with unreachable exit condition ('infinite loop') in the MigTD's ... | check |
| CVE-2026-55716 | Out-of-bounds read in the CheckUefiVgaMode for the Intel(R) Server Boa ... | check |
| CVE-2026-56432 | Unintended proxy or intermediary ('confused deputy') in the MigTD sign ... | check |
| CVE-2026-56435 | Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Boa ... | check |
| CVE-2026-56438 | Uncontrolled search path for the libva software for all versions withi ... | check |
| CVE-2026-56440 | Improper input validation for some BigDL before version 2.5.0b1 within ... | check |
| CVE-2026-56759 | Improper input validation in the MigTD PCI BAR handling for the Intel( ... | check |
| CVE-2026-56816 | Netty is a network application framework for development of protocol s ... | check, potentially only in 4.2.y series |
| CVE-2026-56818 | Netty is an asynchronous, event-driven network application framework. ... | check missing upstream GHSA |
| CVE-2026-57500 | REVA is an interoperability platform. Prior to versions 2.40.5 and 2.4 ... | check |
| CVE-2026-57862 | Kanboard 1.2.52 and prior contains a server-side request forgery vulne ... | check upstream report |
| CVE-2026-57882 | Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Boa ... | check |
| CVE-2026-57884 | Uncontrolled search path for some Intel(R) Graphics Software before ve ... | check |
| CVE-2026-57890 | Improper cleanup on thrown exception in the MigTD's SPDM responder for ... | check |
| CVE-2026-57891 | Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Boa ... | check |
| CVE-2026-57892 | Insufficient granularity of access control in the MigTD v2 policy eval ... | check |
| CVE-2026-57893 | Incomplete internal state distinction in the MigTD's SPDM responder fo ... | check |
| CVE-2026-58505 | geojson-vt is a JavaScript library for slicing GeoJSON data into vecto ... | check |
| CVE-2026-59771 | Improper validation of array index in the MigTD's virtio-serial driver ... | check |
| CVE-2026-60020 | Missing release of memory after effective lifetime in the MigTD virtio ... | check |
| CVE-2026-60035 | A high privileged remote attacker can perform a code injection in the ... | check |
| CVE-2026-60036 | A high privileged remote attacker can perform a code injection in the ... | check |
| CVE-2026-60037 | A high privileged remote attacker can perform an OpenSSL code injectio ... | check |
| CVE-2026-60038 | A high privileged remote attacker can perform an OpenSSL code injectio ... | check |
| CVE-2026-60039 | A high privileged remote attacker can perform a code injection in the ... | check |
| CVE-2026-60040 | An unauthenticated remote attacker can perform a DoS in the backends b ... | check |
| CVE-2026-60041 | An unauthenticated remote attacker can perform a CSRF attack on a logg ... | check |
| CVE-2026-60042 | An unauthenticated remote attacker can perform an authentication bypas ... | check |
| CVE-2026-60043 | An unauthenticated remote attacker can perform a XSS attack on a logge ... | check |
| CVE-2026-60044 | The backups created by the application use a weak static password allo ... | check |
| CVE-2026-60045 | A high privileged remote attacker can upload arbitrary files to a gues ... | check |
| CVE-2026-60046 | An unauthenticated remote attacker can perform password resets for any ... | check |
| CVE-2026-60059 | Use of uninitialized resource in the MigTD memory for the Intel(R) TDX ... | check |
| CVE-2026-60071 | Improper validation of specified quantity in input in the MigTD vsock ... | check |
| CVE-2026-60133 | Integer overflow in the MigTD vsock for the Intel(R) TDX Migration Tru ... | check |
| CVE-2026-60138 | Use of out-of-range pointer offset in the MigTD's virtio-vsock impleme ... | check |
| CVE-2026-60139 | Improper neutralization in the MigTD SPDM transport for the Intel(R) T ... | check |
| CVE-2026-60141 | Improper null termination for some Intel(R) Metrics Discovery Applicat ... | check |
| CVE-2026-60142 | Write-what-where condition in the MigTD for the Intel(R) TDX Migration ... | check |
| CVE-2026-61377 | Sensitive information uncleared in resource before release for reuse i ... | check |
| CVE-2026-61383 | Incorrect calculation of buffer size in the MigTD's servtd_get_quote f ... | check |
| CVE-2026-61467 | Use after free in the MigTD virtio driver for the Intel(R) TDX Migrati ... | check |
| CVE-2026-61468 | Improper privilege management in the MigTD logging for the Intel(R) TD ... | check |
| CVE-2026-61469 | Off-by-one error in the MigTD's vmcall_raw transport for the Intel(R) ... | check |
| CVE-2026-61470 | Improper control of a resource through its lifetime in the MigTD's TLS ... | check |
| CVE-2026-61473 | Authentication bypass by capture-replay in the MigTD for the Intel(R) ... | check |
| CVE-2026-61619 | The OWASP core rule set (CRS) is a set of generic attack detection rul ... | check |
| CVE-2026-61637 | Icinga Web 2 is an open source monitoring web interface, framework and ... | check |
| CVE-2026-61711 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-61712 | BuildKit is a toolkit for converting source code to build artifacts in ... | check potential security impact on docker.io |
| CVE-2026-61887 | Missing critical step in authentication in the MigTD SPDM rebind imple ... | check |
| CVE-2026-62275 | Detection of error condition without action in the MigTD's vmcall_raw ... | check |
| CVE-2026-62846 | SQUID-2026:9 | check SQUID-2026:9 information not yet public |
| CVE-2026-62920 | Unchecked return value in the MigTD error handling for the Intel(R) TD ... | check |
| CVE-2026-62929 | Expired pointer dereference in the MigTD's virtio-vsock implementation ... | check |
| CVE-2026-62930 | Unchecked return value in the MigTD's TLS implementation for the Intel ... | check |
| CVE-2026-62971 | The OWASP core rule set (CRS) is a set of generic attack detection rul ... | check |
| CVE-2026-63018 | Integer underflow (wrap or wraparound) for some Intel(R) Metrics Disco ... | check |
| CVE-2026-63027 | Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) ... | check |
| CVE-2026-63028 | Improper initialization in the MigTD virtio-vsock stream handling for ... | check |
| CVE-2026-63505 | Probo is a self-hostable governance, risk, and compliance (GRC) platfo ... | check |
| CVE-2026-63540 | Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 ... | check |
| CVE-2026-64611 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() ... | check use in embedded cups, cups-filters |
| CVE-2026-64855 | soapbar is a SOAP library for Python \u2014 client, server, and WSDL h ... | check |
| CVE-2026-64858 | vulnerability-operator scans SBOMs and Images for vulnerabilities. Pri ... | check |
| CVE-2026-64861 | Probo is a self-hostable governance, risk, and compliance (GRC) platfo ... | check |
| CVE-2026-65160 | NVIDIA nvJPEG contains a vulnerability where an attacker could cause a ... | check |
| CVE-2026-65820 | aeon is a scikit-learn compatible Python library for learning from tim ... | check |
| CVE-2026-65833 | iopress is a native HTTP server for Node.js with platform-specific asy ... | check |
| CVE-2026-65840 | Fider is a feedback portal for feature requests and suggestions. Prior ... | check |
| CVE-2026-65843 | sync-rpc runs asynchronous commands synchronously by putting them in a ... | check |
| CVE-2026-65967 | Fider is a feedback portal for feature requests and suggestions. Prior ... | check |
| CVE-2026-68485 | An authorization bypass in website-index.php in Revive Adserver 6.0.8 ... | check |
| CVE-2026-68486 | An authorization bypass in campaign-zone linking in Revive Adserver 6. ... | check |
| CVE-2026-71054 | Vulnerability in Oracle Java SE (component: 2D). Supported versions t ... | check |
| CVE-2026-71266 | tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h ... | check, embedded in src:goxel and src:raylib |
| CVE-2026-71395 | unsafe deserialization in hyphenation loading vulnerability in Apache ... | check |
| CVE-2026-71437 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit for further assessment |
| CVE-2026-71439 | Mermaid is a JavaScript tool that uses Markdown-inspired text to creat ... | check introducing commit, might then be only 11.6.0 and above. |
| CVE-2026-71891 | In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidat ... | check, maybe only introduced in 1.85? |
| CVE-2026-75593 | BuildKit is a toolkit for converting source code to build artifacts in ... | check security impact on docker.io |
| CVE-2026-76078 | Probo is a self-hostable governance, risk, and compliance (GRC) platfo ... | check |
| CVE-2026-76079 | Probo is a self-hostable governance, risk, and compliance (GRC) platfo ... | check |
| CVE-2026-76080 | Probo is a self-hostable governance, risk, and compliance (GRC) platfo ... | check |
| CVE-2026-76182 | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be config ... | check if tracking correct, issue in multiple jetty components |
| CVE-2026-77168 | A cross-site request forgery vulnerability in tracker-invocation.php i ... | check |
| CVE-2026-78178 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects ... | check |
| CVE-2026-79680 | Authentication bypass vulnerability in the password authentication mec ... | check |
| CVE-2026-82978 | An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 a ... | check |
| CVE-2026-83550 | A flaw was found in postgres-exporter. Due to the blank import of `net ... | check, Red Hat bugzilla entry is unhelpful at time of check in 2026-10-06 (only contains a hash reference) |
| CVE-2026-84233 | A flaw was found in rpm. A local attacker could supply a specially cra ... | check upstream details |
| CVE-2026-85632 | Missing authentication for critical function and Improper validation o ... | check |
| CVE-2026-86344 | A flaw was found in 389-ds-base. An unauthenticated remote attacker ca ... | check, not details provided on 2026-10-02 in Red Hat bugzilla |
| CVE-2026-86476 | A flaw was found in gst-plugins-base. A heap buffer overflow can be tr ... | check details when upstream issue public? |
| CVE-2026-87020 | An integer overflow in a specified pitch and buffer-size computation l ... | check, might be a dupe of the existing issues addressed in 1.13, needs clarification |
| CVE-2026-88350 | An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_ ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-88351 | An integer overflow vulnerability exists in the MPack Node API in MPac ... | check, embedded in balboa, bpfilter, pocketpy |
| CVE-2026-89091 | A flaw was found in ansible-core. When installing a collection with `a ... | check, details from Red Hat bugzilla not accessible on 2026-10-09 |
| CVE-2026-89326 | Origin Validation Error vulnerability in Apache XML Graphics Batik: th ... | check |
| CVE-2026-90993 | XXE vulnerability in Apache XML Graphics Batik. This issue affects ... | check |
| CVE-2026-92284 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92382 | An out-of-bounds write flaw was found in usbredir. Starting an isochro ... | check details once Red Hat opens up bugzilla entry |
| CVE-2026-92700 | Caddy is an extensible server platform that uses TLS by default. In ve ... | check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281 |
| CVE-2026-92925 | A flaw was found in Redis community. The cluster bus packet parser, re ... | check if redict affected |
| CVE-2026-93315 | When proxy networking with CA injection is enabled, a build can modify ... | check security impact on docker.io |
| CVE-2026-93316 | If BuildKit daemon is started with --cdi-disabled it can lead to daemo ... | check security impact on docker.io |
| CVE-2026-93317 | An unauthenticated attacker controlling a registry or OCI-layout blob ... | check security impact on docker.io |
| CVE-2026-93318 | A malicious image can advertise DiffIDs from another image while conta ... | check security impact on docker.io |
| CVE-2026-93319 | A malicious external BuildKit frontend can send requests using the int ... | check security impact on docker.io |
| CVE-2026-93320 | BuildKit may be tricked into performing file actions with special file ... | check security impact on docker.io |
| CVE-2026-93321 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93322 | A malicious frontend can submit an LLB definition that causes buildkit ... | check security impact on docker.io |
| CVE-2026-93323 | The Dockerfile frontend loaded the Dockerfile and .dockerignore files ... | check security impact on docker.io |
| CVE-2026-93326 | A build step for a Git source, crafted in a specific way, can bypass s ... | check security impact on docker.io |
| CVE-2026-93879 | Hibernate Validator could allow a remote attacker to cause a denial of ... | check, missing further details in Red Hat bugzilla entry at 2026-10-13 |
| CVE-2026-94125 | Nimbus returns the worker placement of every topology running on a sup ... | check |
| CVE-2026-97036 | On Darwin, building a malicious package that uses cgo could cause arbi ... | check, only a problem when building on Darwin, thus probably safe to mark not-affected |
| CVE-2026-97042 | Building a malicious package that uses "//go:cgo_import_dynamic" or li ... | check, should only be a issue when compiling on Windows |
| CVE-2026-100888 | A weakness has been identified in Trusted Domain Project OpenDKIM up t ... | check upstream details |
| CVE-2026-100889 | A vulnerability was detected in Trusted Domain Project OpenDKIM up to ... | check upstream details |
| CVE-2026-100890 | A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. ... | check upstream details |
| CVE-2026-100891 | A vulnerability has been found in Trusted Domain Project OpenDMARC up ... | check upstream details |
| CVE-2026-100895 | A security flaw has been discovered in Trusted Domain Project OpenARC ... | check |
| CVE-2026-100962 | NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability i ... | check |
| CVE-2026-102289 | zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, ... | check |
| CVE-2026-102643 | AsyncSSH is a Python package which provides an asynchronous client and ... | check |
| CVE-2026-102831 | JupyterLab is an extensible environment for interactive and reproducib ... | check, might be introduced later |
| CVE-2026-103906 | Use of hard-coded MQTT credentials in the AM CLUB mobile application a ... | check |
| CVE-2026-103995 | Response body and chunk parsing would handle non-hex or negative integ ... | check |
| CVE-2026-104060 | Worklenz before 3.3.0 contains an SQL injection vulnerability in the r ... | check |
| CVE-2026-104203 | Traccar is an open source GPS tracking system. From 5.1 until 6.15.0, ... | check |
| CVE-2026-104619 | Untrusted users could roll back security updates when using the Packag ... | check |
| CVE-2026-104620 | A path traversal attack in simulation of actions in the Zypp backend o ... | check |
| CVE-2026-104989 | Uncontrolled search path element in package upload feature in Chaos So ... | check |
| CVE-2026-105440 | Missing authorization in the JSON-RPC web services interface of Extrem ... | check |
| CVE-2026-105454 | RT's automatic link creation for URLs in HTML ticket content does ... | check details from upstream and affected versions |
| CVE-2026-105769 | kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access ... | check |
| CVE-2026-105963 | Externally-Generated Error Message Containing Sensitive Information vu ... | check, NFU, but is embedded in sonic-pi and check if security impacted |
| CVE-2026-105987 | KGS Software tia Viewer is vulnerable to Stored XSS via the annotation ... | check |
| CVE-2026-106017 | Improper certificate validation in the OpenVPN 3 Core library version ... | check, details, embedded in openvpn3-client? |
| CVE-2026-106076 | A vulnerability allowing an authenticated organization-transfer peer t ... | check |
| CVE-2026-106077 | A vulnerability allowing a user with the Veeam Backup for Microsoft 36 ... | check |
| CVE-2026-106078 | A vulnerability allowing an unauthenticated attacker to bypass REST AP ... | check |
| CVE-2026-106803 | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in ... | check |
| CVE-2026-106804 | A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in ... | check |
| CVE-2026-107050 | An issue in libretro RetroArch v1.22.2 allows attackers to force anoth ... | check |
| CVE-2026-107067 | An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local ... | check |
| CVE-2026-107145 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to bru ... | check |
| CVE-2026-107146 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to ses ... | check |
| CVE-2026-107147 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa ... | check |
| CVE-2026-107240 | The Node.js web service on VOS (previously Versa FlexVNF) is used for ... | check |
| CVE-2026-107241 | The Node.js web service on VOS (previously Versa FlexVNF) is used for ... | check |
| CVE-2026-107242 | The Node.js web service on VOS (previously Versa FlexVNF) is used for ... | check |
| CVE-2026-107243 | The Node.js web service on VOS (previously Versa FlexVNF) is used for ... | check |
| CVE-2026-107244 | The Node.js web service on VOS (previously Versa FlexVNF) is used for ... | check |
| CVE-2026-107245 | Versa has confirmed abuffer overflowvulnerabilityin theIPsec implement ... | check |
| CVE-2026-107246 | The Plesk extension "Site Import" before 1.13.2 does not properly vali ... | check |
| CVE-2026-107247 | An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows ... | check |
| CVE-2026-107356 | U.S. Geological Survey Area Species Management Research Program (ARMI) ... | check |
| CVE-2026-107662 | Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an aut ... | check |
| CVE-2026-107671 | A vulnerability allowing an attacker with valid Administrator credenti ... | check |
| CVE-2026-108093 | A flaw was found in GIMP. The XCF loader processes image-simulation-in ... | research upstream information, Red Hat bugzilla is not open at 2026-10-09 |
| CVE-2026-108140 | A vulnerability allowing an authenticated user with the Restore Operat ... | check |
| CVE-2026-108141 | A vulnerability allowing an authenticated user with the Restore Operat ... | check |
| CVE-2026-108142 | A vulnerability allowing an unauthenticated attacker to bypass authori ... | check |
| CVE-2026-108270 | | check details from upstream and affected versions |
| CVE-2026-108271 | | check details from upstream and affected versions |
| CVE-2026-108272 | | check details from upstream and affected versions |
| CVE-2026-108273 | | check details from upstream and affected versions |
| CVE-2026-108274 | | check details from upstream and affected versions |
| CVE-2026-108275 | | check details from upstream and affected versions |
| CVE-2026-108276 | | check details from upstream and affected versions |
| CVE-2026-108277 | | check details from upstream and affected versions |
| CVE-2026-108278 | | check details from upstream and affected versions |
| CVE-2026-108279 | | check details from upstream and affected versions |
| CVE-2026-108280 | | check details from upstream and affected versions |
| CVE-2026-108281 | | check details from upstream and affected versions |
| CVE-2026-108282 | | check details from upstream and affected versions |
| CVE-2026-108342 | | check details from upstream and affected versions |
| CVE-2026-108343 | | check details from upstream and affected versions |
| CVE-2026-108344 | | check details from upstream and affected versions |
| CVE-2026-108346 | | check details from upstream and affected versions |
| CVE-2026-108347 | | check details from upstream and affected versions |
| CVE-2026-108348 | | check details from upstream and affected versions |
| CVE-2026-108349 | | check details from upstream and affected versions |
| CVE-2026-108350 | | check details from upstream and affected versions |
| CVE-2026-108351 | | check details from upstream and affected versions |
| CVE-2026-108352 | | check details from upstream and affected versions |
| CVE-2026-108353 | | check details from upstream and affected versions |
| CVE-2026-108363 | | check details from upstream and affected versions |
| CVE-2026-108365 | | check details from upstream and affected versions |
| CVE-2026-108371 | | check details from upstream and affected versions |
| CVE-2026-108558 | A reflected cross-site scripting vulnerability in the conversion-stati ... | check |
| CVE-2026-108559 | A reflected cross-site scripting vulnerability in the iframe invocatio ... | check |
| CVE-2026-108560 | A reflected cross-site scripting vulnerability in updates-history.php ... | check |
| CVE-2026-108561 | A stored cross-site scripting vulnerability in the report date-selecti ... | check |
| CVE-2026-108562 | A stored cross-site scripting vulnerability in maintenance-appendcode- ... | check |
| CVE-2026-108563 | Spreadsheet formula injection in conversion-tracking report exports in ... | check |
| CVE-2026-108564 | A reflected cross-site scripting vulnerability in the invocation-tag g ... | check |
| CVE-2026-108565 | A reflected cross-site scripting vulnerability in the popup invocation ... | check |
| CVE-2026-108752 | JupyterHub through 6.0.1 contains an identifier collision vulnerabilit ... | check, upstream detail |
| CVE-2026-109161 | Insufficient bounds checking in the Digital I/O function may allow a r ... | check |
| CVE-2026-109344 | DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vu ... | possibly not affecting older version, as upstream advisory claims from 3.4.13 on |
| CVE-2026-109582 | Insecure storage of sensitive information issue exists in SS1 provided ... | check |
| CVE-2026-109822 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation conta ... | check |
| CVE-2026-109823 | An attacker can read the name of filesystem paths of your application ... | check |
| CVE-2026-109836 | The Core Temp kernel driver provided by ALCPU is vulnerable to insuffi ... | check |
| CVE-2026-110021 | PLCnext Engineer checks GSDX manifest reference digests but does not c ... | check |
| CVE-2026-110022 | The PFI plugin framework deploys executable assemblies (DLLs) from a s ... | check |
| CVE-2026-110265 | A specially crafted malformed search query could return results from o ... | check |
| CVE-2026-110468 | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/c ... | check |
| CVE-2026-110469 | WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/u ... | check |
| CVE-2026-110697 | A flaw was found in Quay where the robot account listing function cons ... | check |
| CVE-2026-110826 | Improper Session Invalidation after Authentication Credential Change v ... | check |
| CVE-2026-110928 | | check, unclear if usptream is affected by the specific issue? |
| CVE-2026-110935 | The PFI plugin framework deployment routine does not validate path com ... | check |
| CVE-2026-111036 | Server-side request forgery (SSRF) vulnerability in the Coupa Supplier ... | check |
| CVE-2026-111037 | A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders mo ... | check |
| CVE-2026-111038 | CSV formula injection vulnerability in the export functionality of the ... | check |
| CVE-2026-111040 | The platform allows persistent HTML injection into editable fields man ... | check |
| CVE-2026-111105 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerabilit ... | check |
| CVE-2026-111792 | Uncontrolled Recursion vulnerability in Apache XML Graphics Batik. ... | check |
| CVE-2026-112164 | The LaserGest mobile application encrypts stored assistance portal cre ... | check |
| CVE-2026-112165 | The LaserGest mobile application disables TLS certificate and hostname ... | check |
| CVE-2026-112168 | The Magistra software uses weak custom encryption, relies on an outdat ... | check |
| CVE-2026-112169 | Magistra software contains undocumented backdoor functionality that al ... | check |
| CVE-2026-112170 | The software downloads upgrade files without performing integrity chec ... | check |
| CVE-2026-112171 | An attacker can inject malicious SQL statements through user-controlle ... | check |
| CVE-2026-112172 | CGM XDent and XMedical expose PHP synchronization endpoints that allow ... | check |
| CVE-2026-112174 | Local privilege escalation vulnerability in Iperius Backup 8.8.3, due ... | check |
| CVE-2026-112201 | A flaw was found in the login-failure storage component of Keycloak, t ... | check |
| CVE-2026-112204 | WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint ... | check |
| CVE-2026-112205 | WidzialniCMS is vulnerable toBruteforce Protection Bypassin the loginf ... | check |
| CVE-2026-112214 | A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. Whe ... | check, no details yet (2026-10-20) |
| CVE-2026-112258 | A flaw was found in GIMP. The XCF loader can leave a dangling pointer ... | check, double if isolated correct commit,relation to CVE-2026-112261 |
| CVE-2026-112261 | A flaw was found in GIMP. Opening a crafted XCF that selects a path an ... | check, double if isolated correct commit, relation to CVE-2026-112258 |
| CVE-2026-112353 | GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stor ... | check |
| CVE-2026-112354 | Etrel INCH AC charging station management web interface prior to firmw ... | check |
| CVE-2026-112362 | @fastify/express is a Fastify plugin that runs Express middleware insi ... | check |
| CVE-2026-113362 | Improper Access Control in the program installation folder in NEC Corp ... | check |
| CVE-2026-113363 | Improper Input Validation in the network communication processing in N ... | check |
| CVE-2026-113364 | Buffer Overflow in the data receiving process in NEC Corporation WebSA ... | check |
| CVE-2026-113431 | Allocation of Resources Without Limits or Throttling vulnerability in ... | check |
| CVE-2026-113437 | Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS ... | check |
| CVE-2026-113688 | Server-side request forgery in the SmartIT URL-based attachment featur ... | check |
| CVE-2026-113689 | Stored cross-site scripting in the SmartIT work-notes feature of BMC I ... | check |
| CVE-2026-113690 | Stored cross-site scripting in the SmartIT attachment feature of BMC I ... | check |
| CVE-2026-113691 | Stored cross-site scripting in the SmartIT knowledge-article feature o ... | check |
| CVE-2026-113692 | Path traversal in the SmartIT file-management feature of BMC IT Servic ... | check |
| CVE-2026-113693 | Exposure of sensitive information in the SmartIT system-account settin ... | check |
| CVE-2026-113694 | Improper authorization in the SmartIT user attachment feature of BMC I ... | check |
| CVE-2026-113695 | Reflected cross-site scripting in the SmartIT inline-image attachment ... | check |
| CVE-2026-113696 | Improper authorization in the SmartIT change approval feature of BMC I ... | check |
| CVE-2026-113697 | Reflected cross-site scripting in the agent query feature of BMC Helix ... | check |
| CVE-2026-113702 | A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8 ... | check |
| CVE-2026-114031 | Incorrect permission assignment allows local privilege escalation to S ... | check |
| CVE-2026-114032 | The OpenSSL library bundled with the Illumio VEN for Windows is affect ... | check |
| CVE-2026-114358 | This vulnerability exists in the Radius Xenia M2M Platform due to insu ... | check |
| CVE-2026-114549 | NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution ... | check |
| CVE-2026-114594 | A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk ... | check |
| CVE-2026-114595 | In EPICS Base release 7.0.10 and prior, an integer overflow in network ... | check |
| CVE-2026-114596 | In EPICS Base release 7.0.10 and prior, an improper validation of mess ... | check |
| CVE-2026-114597 | In EPICS Base release 7.0.10 and prior, an insufficient validation of ... | check |
| CVE-2026-114598 | In EPICS Base release 7.0.10 and prior, an insufficient validation of ... | check |
| CVE-2026-115538 | Moby's overlay network driver does not restore the iptables rules for ... | check |
| CVE-2026-115539 | SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS id ... | check |
| CVE-2026-115541 | HumHub Community Edition 1.19.0 contains a stored cross-site scripting ... | check |
| CVE-2026-115559 | IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, ima ... | check |
| CVE-2026-115640 | LimeSurvey Community Edition 7.7.0 contains a stored cross-site script ... | check |
| CVE-2026-115700 | Interpretation Conflict vulnerability in hackney_url in benoitc hackne ... | check |
| CVE-2026-115701 | Allocation of Resources Without Limits or Throttling vulnerability in ... | check |
| CVE-2026-115738 | SQL injection vulnerability in DLP on-prem extensions version 11.13.1 ... | check |
| CVE-2026-115739 | Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem e ... | check |
| CVE-2026-115740 | Server side request forgery vulnerability exists in the DLP on-prem ex ... | check |
| CVE-2026-115758 | SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and ... | check |
| CVE-2026-115770 | Pocket ID is an OIDC provider that allows users to authenticate with t ... | check |
| CVE-2026-115779 | Effect is a TypeScript framework that consists of several packages tha ... | check |
| CVE-2026-115791 | When tarfile or zipfile command line interface (CLI) is used to decom ... | check |
| CVE-2026-115878 | Stanza is a Stanford NLP Python library for tokenization, sentence seg ... | check |
| CVE-2026-115924 | Rembg is a tool to remove images background. Prior to 2.0.82, the publ ... | check |
| CVE-2026-115934 | An unauthenticated SQL injection can occur on the front end of any sit ... | check |
| CVE-2026-116070 | Docker-Proxy through 5.1.9 contains a missing authentication vulnerabi ... | check |
| CVE-2026-116081 | Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPa ... | check |
| CVE-2026-116337 | Uncontrolled resource consumption vulnerability in the Qt Framework HT ... | check |
| CVE-2026-116468 | A flaw was found in the group-move and organization group reparenting ... | check |
| CVE-2026-116645 | LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerabi ... | check |
| CVE-2026-116687 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-116688 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ... | check |
| CVE-2026-116725 | gbsplay through 0.0.103 contains an out-of-bounds read vulnerability i ... | check |
| CVE-2026-116726 | Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116727 | gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116728 | libfvde through 20260923 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116729 | libfvde through 20260923 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116735 | libpff through 20260926 contains an off-by-one bounds check in libpff_ ... | check |
| CVE-2026-116736 | Libpff through 20260926 contains a heap out-of-bounds read vulnerabili ... | check |
| CVE-2026-116737 | libphdi through 20260902 contains a heap out-of-bounds read vulnerabil ... | check |
| CVE-2026-116845 | NetBox from 2.9.0 before 4.7.4 contains a broken access control vulner ... | check |
| CVE-2026-117373 | Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Tra ... | check |
| CVE-2026-117477 | KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP hea ... | check |
| CVE-2026-118368 | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability i ... | check |
| CVE-2026-118383 | A use-after-free in the replication component of MongoDB Server can oc ... | check |
| CVE-2026-118391 | Allocation of Resources Without Limits or Throttling vulnerability in ... | check |
| CVE-2026-118450 | Venere is installed outside Program Files and loads/registers unsigned ... | check |
| CVE-2026-118458 | The shared AIS login routing selects a production-shipped test DAO and ... | check |
| CVE-2026-118459 | A time-derived emergency password can be derived from publicly availab ... | check |
| CVE-2026-118460 | Embedded private keys protected by a shared password can be used to si ... | check |
| CVE-2026-118461 | The shared client accepts caller-controlled doctor identifiers for rea ... | check |
| CVE-2026-118462 | Update components download and execute code without proper authenticit ... | check |
| CVE-2026-118464 | Shared cryptographic services use fixed vendor-wide secrets, determini ... | check |
| CVE-2026-118465 | Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM ... | check |
| CVE-2026-118467 | Shared telemetry and logging components store or transmit patient and ... | check |
| CVE-2026-118468 | XML parsers process attacker-influenced update manifests or network re ... | check |
| CVE-2026-118492 | In Eclipse Langium versions 3.0.0 and later, the langium-sprotty packa ... | check |
| CVE-2026-118505 | Improper Restriction of Excessive Authentication Attempts vulnerabilit ... | check |
| CVE-2026-118670 | OHIF Viewers is a zero-footprint DICOM viewer with shared extension pa ... | check |
| CVE-2026-118790 | Multiple hardcoded credentials are embedded within product components ... | check |
| CVE-2026-118791 | The application implements software update functionality without adequ ... | check |
| CVE-2026-118792 | Default credentials permit access through AcuXDBC. | check |
| CVE-2026-118795 | Administrative roles and module permissions are stored in mutable loca ... | check |
| CVE-2026-118798 | Multiple sensitive authentication data, including credentials, OAuth-r ... | check |
| CVE-2026-119078 | Apache Commons Codec's Blake3 class documented the output of its doFin ... | check |
| CVE-2026-119215 | Authorization Bypass Through User-Controlled Key vulnerability in team ... | check |
| CVE-2026-119234 | mvfst did not adequately merge or compact out-of-order STREAM frame da ... | check |
| CVE-2026-119236 | An mvfst QUIC server retained CRYPTO frame data received at an encrypt ... | check |
| CVE-2026-119278 | MariaDB Connector/J is used to connect applications developed in Java ... | check, details + correctness |
| CVE-2026-119446 | Session Fixation vulnerability in the CLI login flow in nerves-hub ner ... | check |
| CVE-2026-119474 | Incorrect Permission Assignment for Critical Resource vulnerability in ... | check |
| CVE-2026-119567 | vsftpd through 3.0.5 contains an access control bypass vulnerability t ... | upstream needs to be contacted, no upstream blessed patch |
| CVE-2026-119613 | Generation of Error Message Containing Sensitive Information vulnerabi ... | check |
| CVE-2026-119723 | When parsing request variables such as query-string and form parameter ... | check |
| CVE-2026-119736 | Attendo (formerly Petpooja Payroll) Admin Android application version ... | check |
| CVE-2026-119737 | The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipp ... | check |
| CVE-2026-119738 | The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic ... | check |
| CVE-2026-119739 | The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic ... | check |
| CVE-2026-119740 | Nexbox A95X TV boxes built on the Amlogic S905X platform contain an un ... | check |
| CVE-2026-119742 | Nagios XI before 2026R2 contains an OS command injection vulnerability ... | check |
| CVE-2026-119743 | pdfmake before 0.3.14 contains a shared resource caching vulnerability ... | check |
| CVE-2026-119755 | Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site ... | check |
| CVE-2026-119756 | Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-o ... | check |
| CVE-2026-119759 | TrailBase 0.28.2 before 0.35.10 contains an insecure direct object ref ... | check |
| CVE-2026-120286 | Missing Authorization vulnerability in the device and deployment group ... | check |
| CVE-2026-120295 | Incorrect Authorization vulnerability in the devices page bulk move in ... | check |
| CVE-2026-120386 | Effekseer improperly validates "effect" files. When a crafted effect f ... | check |
| CVE-2026-120399 | A flaw was found in flightctl. A TLS handshake is performed synchronou ... | check |
| CVE-2026-120443 | GoFound through 1.4.1 contains a stored cross-site scripting vulnerabi ... | check |
| CVE-2026-120444 | GoFound through 1.4.1 contains a path traversal vulnerability that all ... | check |
| CVE-2026-120447 | HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerabi ... | check |
| CVE-2026-120455 | rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability ... | check |
| CVE-2026-120730 | Improperly Controlled Modification of Dynamically-Determined Object At ... | check |
| CVE-2026-120803 | A use-after-free issue exists in MongoDB\u2019s SBE (Slot-Based Execut ... | check |
| CVE-2026-120804 | A flaw exists in the server-side SSPI Kerberos authentication handler ... | check |
| CVE-2026-120805 | In MongoDB Server, an authenticated user with insert privileges on a c ... | check |
| CVE-2026-120806 | A flaw in MongoDB Server's user management commands may lead to incomp ... | check |
| CVE-2026-120807 | A flaw in MongoDB\u2019s X.509 cluster-membership authentication guard ... | check |
| CVE-2026-120808 | An issue exists in MongoDB's macOS TLS client implementation where cer ... | check |
| CVE-2026-120809 | A use-after-free read issue exists in MongoDB\u2019s SBE (Slot-Based E ... | check |
| CVE-2026-120810 | An issue in MongoDB server\u2019s aggregation framework allows an auth ... | check |
| CVE-2026-120811 | A use-after-free issue exists in the MongoDB server\u2019s classic que ... | check |
| CVE-2026-120812 | An issue in MongoDB Server's query processing component allows an auth ... | check |
| CVE-2026-120813 | An issue in MongoDB Server's client-side field-level encryption (CSFLE ... | check |
| CVE-2026-120814 | An improper privilege management issue in the sharding subsystem of Mo ... | check |
| CVE-2026-120815 | An incorrect authorization check in the MongoDB Server authorization s ... | check |
| CVE-2026-120816 | A user with basic read-tier database privileges can use an option on a ... | check |
| CVE-2026-120817 | A race condition in the schema validation component of MongoDB Server ... | check |
| CVE-2026-120818 | A use-after-free weakness in MongoDB Server's server-side JavaScript s ... | check |
| CVE-2026-120819 | A memory-management flaw in the server-side JavaScript execution compo ... | check |
| CVE-2026-120820 | MongoDB Server maintains an in-memory table of per-namespace statistic ... | check |
| CVE-2026-120821 | A use-after-free in the aggregation framework of MongoDB Server can oc ... | check |
| CVE-2026-120822 | MongoDB Server may omit an authorization check on the resource that a ... | check |
| CVE-2026-120823 | A missing authorization check in the aggregation framework of MongoDB ... | check |
| CVE-2026-120824 | A use-after-free in the time-series collection component of MongoDB Se ... | check |
| CVE-2026-120825 | An authorization weakness in the aggregation framework of MongoDB Serv ... | check |
| CVE-2026-120826 | An authorization flaw in the aggregation and view-definition handling ... | check |
| CVE-2026-120828 | A replica-set database server node does not limit or reclaim internal ... | check |
| CVE-2026-120953 | A URI redirection weakness exists in the authentication component of t ... | check |
| CVE-2026-120997 | Improper Session Invalidation vulnerability in the dashboard pages, de ... | check |
| CVE-2026-120999 | Improper Authentication vulnerability in Google sign-in and email conf ... | check |
| CVE-2026-121191 | Missing Authorization vulnerability in T\xdcB\u0130TAK B\u0130LGEM Sof ... | check |
| CVE-2026-121267 | Incorrect default permissions vulnerability in T\xdcB\u0130TAK B\u0130 ... | check |
| CVE-2026-121520 | In BuildKit versions prior to v0.34.1, a malicious client with access ... | check security impact on docker.io |
| CVE-2026-121522 | In BuildKit versions v0.26.0 through v0.34.1, a specific build definit ... | check security impact on docker.io |
| CVE-2026-121691 | Improper Handling of Highly Compressed Data (CWE-409) in the ZIP loade ... | check |
| CVE-2026-121841 | Other issue in Firefox for iOS. This vulnerability was fixed in Firefo ... | check |
| CVE-2026-121842 | Privilege escalation in the Reader View component in Firefox for iOS. ... | check |
| CVE-2026-121843 | Privilege escalation in Firefox for iOS. This vulnerability was fixed ... | check |
| CVE-2026-121885 | A flaw was found in Podman. An attacker can trigger a Denial of Servic ... | check |
| CVE-2026-122043 | repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vuln ... | check |
| CVE-2026-122056 | A flaw was found in OpenSCAP. A heap-based buffer overflow can occur w ... | check for upstream report |
| CVE-2026-122096 | Uncontrolled Resource Consumption vulnerability in the sketch deserial ... | check |
| CVE-2026-123040 | An attacker who gains the ability to execute arbitrary code on a syste ... | check |
| CVE-2026-123084 | An **expression language injection** has been found in the HeaderConte ... | check |
| CVE-2026-123717 | OS command injection in the pass and bitwarden credential providers in ... | check |
| CVE-2026-123747 | A flaw was found in pappl-retrofit. The application fails to properly ... | check |
| CVE-2026-123808 | Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind ... | check |
| CVE-2026-123818 | LMDeploy is a toolkit for compressing, deploying, and serving large la ... | check |
| CVE-2026-123828 | A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling let ... | check |
| CVE-2026-123829 | A Permission Model bypass in Node.js recursive file watching discloses ... | check |
| CVE-2026-123862 | An uncatchable exception in the Node.js zlib streaming API lets a peer ... | check |
| CVE-2026-123863 | A reachable assertion in Node.js HTTP/2 session teardown lets any unau ... | check |
| CVE-2026-123864 | A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client rea ... | check |
| CVE-2026-123865 | An unauthenticated HTTP/2 client can permanently leak Node.js server m ... | check |
| CVE-2026-123866 | A use-after-free in Node.js HTTP/2 stream teardown can leak response m ... | check |
| CVE-2026-123867 | A per-host mutual-TLS authorization bypass in Node.js lets a client au ... | check |
| CVE-2026-123868 | An unauthenticated HTTP/2 client can exhaust Node.js server memory bec ... | check |
| CVE-2026-123870 | The otterdog webapp evaluates a format-string built from the incoming ... | check |
| CVE-2026-123871 | Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error ... | check |
| CVE-2026-123872 | A client certificate authentication bypass in Node.js TLS lets a clien ... | check |
| CVE-2026-123874 | A use-after-free in Node.js HTTP/2 lets an unauthenticated client corr ... | check |
| CVE-2026-123875 | A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated c ... | check |
| CVE-2026-123877 | A certificate validation bypass in Node.js https.Agent lets a cached T ... | check |
| CVE-2026-123999 | NASA JPL ION-DTN 3.6.2 through 4.2.0 contains a heap-based buffer over ... | check |
| CVE-2026-124000 | NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allo ... | check |
| CVE-2026-124001 | NASA JPL ION-DTN 2.2.1b through 4.2.0 contains an integer overflow vul ... | check |
| CVE-2026-124016 | postal-mime before 4.2.1 contains an algorithmic complexity denial of ... | check |
| CVE-2026-124077 | The GitIdentifiers class in Apache Commons Codec did not reject NUL by ... | check |
| CVE-2026-124079 | rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 contain ... | check |
| CVE-2026-124249 | http.cookiejar.CookieJar deleted a stored cookie when a response carri ... | check |
| CVE-2026-124495 | When workers run as the topology owner, the Logviewer serves files tha ... | check |
| CVE-2026-124496 | The DRPC HTTP endpoint lets an authenticated client act as another use ... | check |
| CVE-2026-124503 | A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0 ... | check |
| CVE-2026-124584 | A vulnerability has been found in wummel patool 4.1.0. This vulnerabil ... | check, no public details yet at 2026-11-10 |
| CVE-2026-124737 | A flaw was found in BusyBox. When the TFTP (Trivial File Transfer Prot ... | check |
| CVE-2026-124738 | A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-comp ... | check |
| CVE-2026-124739 | A flaw was found in BusyBox. When the httpd web server processes subdi ... | check |
| CVE-2026-124740 | A flaw was found in BusyBox's udhcpc6 DHCPv6 client. A malicious serve ... | check |
| CVE-2026-124741 | A flaw was found in BusyBox. The udhcpc6 DHCPv6 client does not proper ... | check |
| CVE-2026-124742 | A flaw was found in BusyBox. The volume identification component fails ... | check |
| CVE-2026-124743 | A flaw was found in BusyBox. When processing filesystem metadata, the ... | check |
| CVE-2026-124744 | A flaw was found in BusyBox. When extracting files using the cpio util ... | check |
| CVE-2026-124745 | A flaw was found in BusyBox. When extracting an archive, the tar utili ... | check |
| CVE-2026-124746 | A flaw was found in BusyBox. An integer overflow occurs in the volume_ ... | check |
| CVE-2026-124747 | A flaw was found in BusyBox. When resuming a download over File Transf ... | check |
| CVE-2026-124834 | A security vulnerability has been detected in iomad up to 4.5.15/5.0.1 ... | check |
| CVE-2026-124952 | Use-after-free in the Audio/Video component. This vulnerability was fi ... | check |
| CVE-2026-124987 | A vulnerability has been found in mikefarah yq up to 4.53.3. This affe ... | check |
| CVE-2026-124992 | A vulnerability was identified in nushell up to 0.116.1. Impacted is t ... | check |
| CVE-2026-124994 | A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1 ... | check |
| CVE-2026-124996 | A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. ... | check |
| CVE-2026-124999 | A security vulnerability has been detected in braindecode up to 1.8.2. ... | check |
| CVE-2026-125064 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125065 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125066 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125067 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125068 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125069 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125070 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125071 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125072 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125073 | FFmpeg through 9.0.2 contains an infinite loop vulnerability in bit_al ... | check |
| CVE-2026-125095 | FFmpeg through 9.0.2 contains an uninitialized memory use vulnerabilit ... | check |
| CVE-2026-125096 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125097 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125098 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125099 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125100 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in the ... | check |
| CVE-2026-125101 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125102 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125103 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125104 | FFmpeg through 9.0.2 contains a memory exhaustion vulnerability in ape ... | check |
| CVE-2026-125107 | Muhammara is a node module with c/cpp bindings to modify PDF with Java ... | check |
| CVE-2026-125112 | djust provides Phoenix LiveView-style reactive server-side rendering f ... | check |
| CVE-2026-125113 | The XRootD project provides a high-performance, fault-tolerant, and se ... | check |
| CVE-2026-125114 | Novu provides an API for sending notifications through multiple channe ... | check |
| CVE-2026-125115 | Novu provides an API for sending notifications through multiple channe ... | check |
| CVE-2026-125116 | Mongoose is a MongoDB object modeling tool designed to work in an asyn ... | check |
| CVE-2026-125117 | Mongoose is a MongoDB object modeling tool designed to work in an asyn ... | check |
| CVE-2026-125118 | Mongoose is a MongoDB object modeling tool designed to work in an asyn ... | check |
| CVE-2026-125119 | Mongoose is a MongoDB object modeling tool designed to work in an asyn ... | check |
| CVE-2026-125120 | Mongoose is a MongoDB object modeling tool designed to work in an asyn ... | check |
| CVE-2026-125170 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125171 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in t ... | check |
| CVE-2026-125172 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in l ... | check |
| CVE-2026-125173 | FFmpeg through 9.0.2 contains a memory leak vulnerability in libxevd_r ... | check |
| CVE-2026-125174 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a NULL pointer deref ... | check |
| CVE-2026-125175 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125176 | FFmpeg through 9.0.2 contains an uninitialized memory read vulnerabili ... | check |
| CVE-2026-125177 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125178 | FFmpeg through 9.0.2 contains an out-of-bounds heap read vulnerability ... | check |
| CVE-2026-125179 | FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in ... | check |
| CVE-2026-125180 | FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in ... | check |
| CVE-2026-125181 | FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in ... | check |
| CVE-2026-125182 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in t ... | check |
| CVE-2026-125183 | FFmpeg through 9.0.2 contains a denial of service vulnerability in pps ... | check |
| CVE-2026-125184 | FFmpeg 6.1 through 9.0.2 contains an information disclosure vulnerabil ... | check |
| CVE-2026-125185 | FFmpeg through 9.0.2 contains a division by zero vulnerability in ff_a ... | check |
| CVE-2026-125186 | FFmpeg through 9.0.2 contains an uncontrolled resource consumption vul ... | check |
| CVE-2026-125187 | FFmpeg through 9.0.2 contains a reachable assertion vulnerability in t ... | check |
| CVE-2026-125188 | FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability ... | check |
| CVE-2026-125189 | FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in ... | check |
| CVE-2026-125190 | FFmpeg through 9.0.2 contains an information disclosure vulnerability ... | check |
| CVE-2026-125191 | FFmpeg through 9.0.2 contains a reference count leak in libavcodec/v4l ... | check |
| CVE-2026-125192 | FFmpeg through 9.0.2 contains an uninitialized memory vulnerability in ... | check |
| CVE-2026-125193 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in b ... | check |
| CVE-2026-125194 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in p ... | check |
| CVE-2026-125195 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125196 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125197 | FFmpeg through 9.0.2 contains an integer underflow in decode_frame() i ... | check |
| CVE-2026-125198 | FFmpeg through 9.0.2 contains a memory leak vulnerability in mediaform ... | check |
| CVE-2026-125199 | FFmpeg through 9.0.2 contains a memory leak vulnerability in vc1_decod ... | check |
| CVE-2026-125200 | FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcode ... | check |
| CVE-2026-125201 | FFmpeg 7.0 before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bo ... | check |
| CVE-2026-125202 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125203 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overfl ... | check |
| CVE-2026-125204 | FFmpeg through 9.0.2 contains a heap buffer overflow in ff_libwebp_get ... | check |
| CVE-2026-125205 | FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerabi ... | check |
| CVE-2026-125206 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in t ... | check |
| CVE-2026-125207 | FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulner ... | check |
| CVE-2026-125208 | FFmpeg through 9.0.2 contains an out-of-bounds write vulnerability in ... | check |
| CVE-2026-125209 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap buffer overfl ... | check |
| CVE-2026-125210 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125211 | FFmpeg through 9.0.2 contains an out-of-bounds read and invalid free v ... | check |
| CVE-2026-125212 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125213 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125214 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125215 | FFmpeg 7.1 through 9.0.2 contains a NULL pointer dereference vulnerabi ... | check |
| CVE-2026-125216 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125217 | FFmpeg through 9.0.2 contains an uninitialized memory use vulnerabilit ... | check |
| CVE-2026-125218 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125219 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125220 | FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode ... | check |
| CVE-2026-125221 | FFmpeg through 9.0.2 contains an uncontrolled recursion vulnerability ... | check |
| CVE-2026-125222 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap ... | check |
| CVE-2026-125223 | FFmpeg 8.0 through 9.0.2 contains a memory leak vulnerability in the V ... | check |
| CVE-2026-125224 | FFmpeg through 9.0.2 contains a denial of service vulnerability in lib ... | check |
| CVE-2026-125225 | FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability ... | check |
| CVE-2026-125226 | FFmpeg through 9.0.2 contains an uncontrolled memory allocation vulner ... | check |
| CVE-2026-125227 | FFmpeg through 9.0.2 contains an integer overflow in cbs_jpeg_write_sc ... | check |
| CVE-2026-125228 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds rea ... | check |
| CVE-2026-125229 | FFmpeg through 9.0.2 contains an out-of-bounds memory access vulnerabi ... | check |
| CVE-2026-125230 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in the ... | check |
| CVE-2026-125231 | FFmpeg 4.4 through 9.0.2 contains a NULL pointer dereference vulnerabi ... | check |
| CVE-2026-125232 | FFmpeg through 9.0.2 contains a division by zero vulnerability in esti ... | check |
| CVE-2026-125233 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125234 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in wav ... | check |
| CVE-2026-125235 | FFmpeg through 9.0.2 contains a heap overflow vulnerability in libavco ... | check |
| CVE-2026-125236 | FFmpeg through 9.0.2 contains a memory leak vulnerability in alloc_fra ... | check |
| CVE-2026-125237 | FFmpeg 8.1 through 9.0.2 contains a denial of service vulnerability in ... | check |
| CVE-2026-125238 | FFmpeg through 9.0.2 contains a reachable assertion vulnerability in l ... | check |
| CVE-2026-125239 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125240 | FFmpeg through 9.0.2 contains a resource leak vulnerability in svt_jpe ... | check |
| CVE-2026-125241 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125242 | FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcode ... | check |
| CVE-2026-125243 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125244 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an out-of-bounds wri ... | check |
| CVE-2026-125245 | FFmpeg through 9.0.2 contains a memory leak vulnerability in ff_mjpeg_ ... | check |
| CVE-2026-125246 | FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs ... | check |
| CVE-2026-125247 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in dng ... | check |
| CVE-2026-125248 | FFmpeg 9.0 through 9.0.2 contains an integer overflow vulnerability in ... | check |
| CVE-2026-125249 | FFmpeg 7.1 through 9.0.2 contains an integer overflow in ff_vk_decode_ ... | check |
| CVE-2026-125250 | FFmpeg through 9.0.2 contains a heap buffer overflow in the GIF encode ... | check |
| CVE-2026-125251 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in the ... | check |
| CVE-2026-125252 | FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcode ... | check |
| CVE-2026-125253 | FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fra ... | check |
| CVE-2026-125254 | FFmpeg through 9.0.2 contains a division by zero vulnerability in the ... | check |
| CVE-2026-125255 | FFmpeg through 9.0.2 contains a use after free vulnerability in libavc ... | check |
| CVE-2026-125256 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125257 | FFmpeg through 9.0.2 contains an off-by-one heap overflow vulnerabilit ... | check |
| CVE-2026-125258 | FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi ... | check |
| CVE-2026-125259 | FFmpeg through 9.0.2 contains an integer overflow vulnerability in ff_ ... | check |
| CVE-2026-125260 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125261 | FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in t ... | check |
| CVE-2026-125262 | FFmpeg through 9.0.2 contains a heap buffer overflow vulnerability in ... | check |
| CVE-2026-125263 | FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCE ... | check |
| CVE-2026-125264 | FFmpeg through 9.0.2 contains an uncontrolled resource consumption vul ... | check |
| CVE-2026-125265 | FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavc ... | check |
| CVE-2026-125266 | FFmpeg through 9.0.2 contains an uninitialized stack memory disclosure ... | check |
| CVE-2026-125267 | FFmpeg before 8.1.3 and 9.x before 9.0.2 contains a heap out-of-bounds ... | check |
| CVE-2026-125268 | FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ... | check |
| CVE-2026-125269 | FFmpeg through 9.0.2 contains a double free vulnerability in libavcode ... | check |
| CVE-2026-125270 | FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability ... | check |
| CVE-2026-125329 | Kaneo is a project management application with boards, Gantt charts, a ... | check |
| CVE-2026-125330 | HarnessRouter is a self-hosted unified API for agent harnesses. From v ... | check |
| CVE-2026-125331 | HarnessRouter is a self-hosted unified API for running agent harnesses ... | check |
| CVE-2026-125358 | Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8 ... | check |
| CVE-2026-125359 | Mediary Scout before 2026.11.05 contains a server-side request forgery ... | check |
| CVE-2026-125360 | Storyden through 1.26.16 contains a privilege escalation vulnerability ... | check |
| CVE-2026-125361 | Tencent BrowserSkill through 0.4.2 contains a missing authentication v ... | check |
| CVE-2026-125362 | Seahub through 14.0.10 contains a weak randomness vulnerability in Mul ... | check |
| CVE-2026-125363 | MikroDash before 0.8.79 contains a server-side request forgery vulnera ... | check |
| CVE-2026-125364 | frab through 0.9.1 contains a privilege escalation vulnerability that ... | check |
| CVE-2026-125365 | DollarDollar through 4.4 contains a missing authorization vulnerabilit ... | check |
| CVE-2026-125366 | Omnom through 0.9.0 contains a server-side request forgery vulnerabili ... | check |
| CVE-2026-125367 | Pico through 4.1.2 contains a server-side request forgery vulnerabilit ... | check |
| CVE-2026-125652 | A flaw was found in the keycloak-services component of Keycloak, which ... | check |
| CVE-2026-125672 | A flaw was found in cockpit-storaged. A Tang keyserver address read fr ... | check |
| CVE-2026-125709 | A flaw was found in libstdc++. When a byte-by-byte write operation fai ... | check |
| CVE-2026-125715 | Samsung mTower lacks access control for TA sessions, allowing a Normal ... | check |
| CVE-2026-125745 | Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contain ... | check |
| CVE-2026-125747 | ZenTao PMS through 22.7 contains a missing object-level authorization ... | check |
| CVE-2026-125748 | Parabol before 15.21.2 contains a missing authorization vulnerability ... | check |
| CVE-2026-125749 | TaxHacker through 0.8.5 contains an insecure direct object reference v ... | check |
| CVE-2026-125750 | Firekylin through 2.18.1 contains an improper authorization vulnerabil ... | check |
| CVE-2026-125751 | Meteroid before 2.2.0 contains an authorization bypass vulnerability i ... | check |
| CVE-2026-125752 | Meteroid before 2.2.0 contains a cross-tenant authorization bypass vul ... | check |
| CVE-2026-125753 | ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7. ... | check |
| CVE-2026-125755 | Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in add ... | check |
| CVE-2026-125756 | postal-mime before 4.2.1 contains a parser differential vulnerability ... | check |
| CVE-2026-125757 | mailcow: dockerized before 2026-11 contains a server-side template inj ... | check |
| CVE-2026-125758 | Aptabase before commit 61d4c01 contains an authentication bypass vulne ... | check |
| CVE-2026-125759 | Nango before 0.71.3 contains an sql injection vulnerability that allow ... | check |
| CVE-2026-125871 | The sourcecache expansion module in MISP Modules (misp-modules) contai ... | check |
| CVE-2026-125878 | Improper neutralization of input during web page generation ('cross-si ... | check |
| CVE-2026-125879 | Incorrect privilege assignment vulnerability in N-able N-central allow ... | check |
| CVE-2026-125880 | Improper neutralization of HTTP headers for scripting syntax vulnerabi ... | check |
| CVE-2026-125881 | Server-Side request forgery (SSRF) vulnerability in N-able N-central a ... | check |
| CVE-2026-125882 | Relative path traversal vulnerability in N-able N-central allows Path ... | check |
| CVE-2026-125883 | Improper restriction of XML external entity reference vulnerability in ... | check |
| CVE-2026-125958 | Download of code without integrity check vulnerability in N-able N-cen ... | check |
| CVE-2026-126042 | VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerabil ... | check |
| CVE-2026-126048 | Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer over ... | check |
| CVE-2026-126049 | Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN ... | check |
| CVE-2026-126051 | A deferred-callback use-after-destroy in Node.js TLS server handshake ... | check |
| CVE-2026-126065 | OpenObserve is a cloud-native observability platform. Prior to 1.1.0, ... | check |
| CVE-2026-126066 | fast-xml-parser allows users to process XML from JS object without C/C ... | check |
| CVE-2026-126082 | Active Storage makes it simple to upload and reference files in cloud ... | check with CNAs, is duplicate of CVE-2026-122006 |
| CVE-2026-126123 | BeeS Software Solutions ERP before 04 September 2026 allows any low-pr ... | check |
| CVE-2026-126187 | React is a JavaScript library for building user interfaces. From 19.0. ... | check |
| CVE-2026-126325 | A critical remote code execution (RCE) vulnerability has been reported ... | check |
| CVE-2026-126495 | MQTTX desktop through 1.13.3 contains a stored cross-site scripting vu ... | check |
| CVE-2026-126496 | 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vul ... | check |
| CVE-2026-126498 | WriteFreely before 0.17.3 contains a stored cross-site scripting vulne ... | check |
| CVE-2026-126546 | Viber for iOS through 29.4.0.24 fails to validate the logical screen w ... | check |
| CVE-2026-126569 | Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulner ... | check |
| CVE-2026-126612 | Improper link resolution in the Windows installer of Progressive Robot ... | check |
| CVE-2026-126613 | Allocation of resources without limits in the JSON reader of Progressi ... | check |
| CVE-2026-126614 | The web services listener of Progressive Robot hMailServer 6.3.3 throu ... | check |
| CVE-2026-126615 | The sign-in of Progressive Robot hMailServer 6.2.22-pre2 through 6.3.7 ... | check |
| CVE-2026-126616 | The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, wit ... | check |
| CVE-2026-126617 | SQL injection in the database layer of Progressive Robot hMailServer 6 ... | check |
| CVE-2026-126618 | The auto-ban of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 c ... | check |
| CVE-2026-126619 | Misinterpretation of SQL statement text in the database layer of Progr ... | check |
| CVE-2026-126621 | Progressive Robot hMailServer 6.0.0-B1 through 6.3.7 on Windows hands ... | check |
| CVE-2026-126622 | Incorrect default permissions in the Windows installer of Progressive ... | check |
| CVE-2026-126623 | Inefficient algorithmic complexity in the JSON reader of Progressive R ... | check |
| CVE-2026-126624 | Unverified ownership in the Windows installer of Progressive Robot hMa ... | check |
| CVE-2026-126625 | Incorrect default permissions in the Windows installer of Progressive ... | check |
| CVE-2026-126626 | The web services listener of Progressive Robot hMailServer 6.3.3 throu ... | check |
| CVE-2026-126627 | Creation of Temporary File With Insecure Permissions vulnerability in ... | check |
| CVE-2026-126658 | ByteStash 1.5.10 before 1.6.2 contains an insufficient session expirat ... | check |
| CVE-2026-126659 | BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource ... | check |
| CVE-2026-126662 | Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0. ... | check |
| CVE-2026-126663 | Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0. ... | check |
| CVE-2026-126720 | Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code exe ... | check |
| CVE-2026-126722 | Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor da ... | check |
| CVE-2026-126723 | Rooxis RXR-12 Wi-Fi router contains an authenticated command injection ... | check |
| CVE-2026-126724 | Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor acc ... | check |
| CVE-2026-126766 | OpsTree REMS through 1.0.0 contains an improper authorization vulnerab ... | check |
| CVE-2026-126767 | OpsTree REMS through 1.0.0 contains a prompt injection vulnerability t ... | check |
| CVE-2026-126768 | OpsTree REMS through 1.0.0 contains an authentication bypass vulnerabi ... | check |
| CVE-2026-126769 | OpsTree REMS through 1.0.0 contains a missing authentication vulnerabi ... | check |
| CVE-2026-126770 | OpsTree REMS through 1.0.0 contains a server-side request forgery vuln ... | check |
| CVE-2026-126771 | OpsTree REMS through 1.0.0 contains a stored cross-site scripting vuln ... | check |
| CVE-2026-126772 | OpsTree REMS through 1.0.0 contains an improper attribution vulnerabil ... | check |
| CVE-2026-126774 | @tinacms/mdx before 2.4.2 contains a code injection vulnerability in i ... | check |
| CVE-2026-126775 | Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site reques ... | check |
| CVE-2026-126777 | Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerabi ... | check |
| CVE-2026-126778 | Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vuln ... | check |
| CVE-2026-126779 | Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulne ... | check |
| TEMP-1142597-FFA22A | GHSA-68ff-gq39-pqjm: relay: authentication bypass with the "plain" password hash algorithm | check, GHSA-68ff-gq39-pqjm claims >= 4.3.0 but potentially since v2.9-rc1 |