CVE-2026-78357
(9.1 CRITICAL)

EPSS: 0.30%

updated 2026-10-12T09:31:29

4 posts

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an existing JWT may remain valid until its regular expiration time, which can be approximately 16 hours. An attacker who has previously obtained a valid authentication token can therefore continue to access OTRS with the privil

CVE-2026-78355
(8.7 HIGH)

EPSS: 0.72%

updated 2026-10-12T09:31:29

2 posts

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating system file permissions. On OTRS versions prior to OTRS 7, the effective permissions of the web server proc

CVE-2026-93582
(9.4 CRITICAL)

EPSS: 0.39%

updated 2026-10-12T09:31:29

4 posts

The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior accept the authenticated username from either the REMOTE_USER or HTTP_REMOTE_USER environment variable. In CGI and mod_perl based deployments, HTTP request headers may be mapped to corresponding HTTP_* environment variables. As a result, an unauthenticated remote attacker can supply a crafted Remote-User request header

CVE-2026-1907
(0 None)

EPSS: 0.13%

updated 2026-10-12T09:16:43.683000

2 posts

A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane (CP), leading to potential unauthorized database access. Leveraging the issue requires network access to the Control Plane’s clustering port and a valid client certificate

CVE-2026-79992
(7.8 HIGH)

EPSS: 0.14%

updated 2026-10-12T08:17:25.537000

1 posts

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.

CVE-2026-87690
(8.8 HIGH)

EPSS: 0.41%

updated 2026-10-12T06:31:24

2 posts

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying

CVE-2026-108804
(10.0 CRITICAL)

EPSS: 2.39%

updated 2026-10-12T06:16:59.457000

2 posts

A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL

CVE-2026-108980
(8.8 HIGH)

EPSS: 1.06%

updated 2026-10-12T03:33:04

1 posts

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Do

CVE-2026-108982(CVSS UNKNOWN)

EPSS: 0.11%

updated 2026-10-12T03:33:04

1 posts

VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB sessi

CVE-2026-108985
(7.1 HIGH)

EPSS: 0.18%

updated 2026-10-12T03:17:18.837000

2 posts

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

CVE-2026-66086
(9.8 CRITICAL)

EPSS: 0.46%

updated 2026-10-12T02:16:57.600000

1 posts

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

CVE-2026-108781
(6.3 MEDIUM)

EPSS: 0.20%

updated 2026-10-12T01:16:29.783000

1 posts

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The expl

CVE-2026-108963
(8.8 HIGH)

EPSS: 1.69%

updated 2026-10-11T21:30:58

1 posts

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.

CVE-2026-108976
(7.8 HIGH)

EPSS: 0.51%

updated 2026-10-11T21:30:57

1 posts

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

CVE-2026-19935
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-11T18:16:59.410000

1 posts

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in l2cap_chan_destroy() in subsys/bluetooth/host/l2cap.c cancels the retransmission-timeout work and drains the RX FI

CVE-2026-19736
(7.8 HIGH)

EPSS: 0.11%

updated 2026-10-11T18:16:58.810000

1 posts

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always copies whole 32-bit words and draws entropy rounded up to a multiple of 128 bytes. Its "caller buffer is full" guard tests dataSize == 0, so a req

CVE-2026-97670
(9.1 CRITICAL)

EPSS: 0.37%

updated 2026-10-11T17:17:08.290000

1 posts

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data toke

CVE-2026-94589
(9.8 CRITICAL)

EPSS: 0.66%

updated 2026-10-11T17:17:07.727000

1 posts

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload

CVE-2026-93746
(7.5 HIGH)

EPSS: 0.53%

updated 2026-10-11T17:17:07.300000

1 posts

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents

CVE-2026-91136
(7.5 HIGH)

EPSS: 0.56%

updated 2026-10-11T17:17:07.010000

1 posts

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — san

1 repos

https://github.com/fl0ydsec/CVE-2026-91136

CVE-2026-33367
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-11T17:17:04.760000

1 posts

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVE-2026-105281
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-11T17:17:01.723000

1 posts

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CVE-2026-104803
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-10-11T17:17:00.970000

2 posts

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i

CVE-2026-108905
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-11T15:31:14

1 posts

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

CVE-2026-108760
(7.6 HIGH)

EPSS: 0.24%

updated 2026-10-11T15:31:13

1 posts

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API keys, modify projects, trigger ingestion, and irreversibly delete projects.

CVE-2026-108739
(7.5 HIGH)

EPSS: 0.32%

updated 2026-10-11T15:31:12

1 posts

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked browserfabric_api_key in each workspace's settings map, along with workspace ids, slugs, creator emails and member lists.

CVE-2026-108740
(8.3 HIGH)

EPSS: 0.33%

updated 2026-10-11T15:31:11

1 posts

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.

CVE-2026-108860
(9.1 CRITICAL)

EPSS: 0.48%

updated 2026-10-11T15:31:08

1 posts

BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign tokens with the committed HMAC secret and fixed botsharp issuer and audience to impersonate any known user, including administrators, on Authorize-protected API routes.

CVE-2026-108865
(8.2 HIGH)

EPSS: 0.32%

updated 2026-10-11T15:31:08

1 posts

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers can register a client, request a code from /authorize, and exchange it at /token to access OAuth2-protected MCP prefixes, proxied upstream APIs and injected credentials.

CVE-2026-108714
(7.5 HIGH)

EPSS: 0.36%

updated 2026-10-11T15:31:06

1 posts

MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize limit. Attackers can send small frame headers declaring payloads near 2 GiB over one or a few connections, forcing huge heap allocations and causing denial of service.

CVE-2026-108576
(10.0 CRITICAL)

EPSS: 2.45%

updated 2026-10-11T15:31:03

1 posts

A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108902
(8.1 HIGH)

EPSS: 0.38%

updated 2026-10-11T15:16:56.447000

1 posts

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members to delete arbitrary files. Attackers can supply ../ sequences in the POST picture_link parameter to remove other members' photos or configuration and cache files, causing content loss and denial of service.

CVE-2026-108863
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-11T14:17:06.360000

1 posts

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.

CVE-2026-108859
(7.5 HIGH)

EPSS: 0.55%

updated 2026-10-11T14:17:05.893000

1 posts

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

CVE-2026-108853
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-11T14:17:04.960000

1 posts

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assistant IDs to permanently delete victims' applications, workflows, conversations, and associated data.

CVE-2026-93945
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:28.400000

3 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVE-2026-93941
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:27.960000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVE-2026-93938
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:27.747000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVE-2026-93937
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:27.643000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVE-2026-93929
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T13:17:26.773000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVE-2026-93927
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T13:17:26.667000

1 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVE-2026-62045
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T13:17:24.780000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVE-2026-108758
(8.2 HIGH)

EPSS: 0.26%

updated 2026-10-11T13:17:21.020000

1 posts

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain managem

CVE-2026-108753
(9.4 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T13:17:20.237000

2 posts

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVE-2026-108746
(8.8 HIGH)

EPSS: 0.28%

updated 2026-10-11T13:17:19.230000

1 posts

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access.

CVE-2026-108718
(8.1 HIGH)

EPSS: 0.27%

updated 2026-10-11T13:17:15.020000

1 posts

Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients without user consent. Attackers can register a client with the long_lived_access_token scope and lure a user to an authorization link, obtaining a non-expiring API token with the user's full permissions.

CVE-2026-106609
(7.5 HIGH)

EPSS: 0.22%

updated 2026-10-11T13:17:12.333000

1 posts

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

CVE-2026-105892
(9.8 CRITICAL)

EPSS: 0.42%

updated 2026-10-11T13:17:11.910000

1 posts

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

CVE-2026-104398
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T13:17:11.270000

2 posts

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVE-2026-93550
(4.3 MEDIUM)

EPSS: 0.18%

updated 2026-10-11T12:32:13

1 posts

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP file

CVE-2026-89234
(8.6 HIGH)

EPSS: 0.27%

updated 2026-10-11T12:31:10

2 posts

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVE-2026-96227
(8.8 HIGH)

EPSS: 0.28%

updated 2026-10-11T12:17:30.353000

2 posts

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

CVE-2026-89232
(8.6 HIGH)

EPSS: 0.27%

updated 2026-10-11T12:17:26.880000

2 posts

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

CVE-2026-89195
(8.6 HIGH)

EPSS: 0.26%

updated 2026-10-11T12:17:26.440000

1 posts

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

CVE-2026-86717
(9.1 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:24.653000

1 posts

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

CVE-2026-81797
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T12:17:22.500000

1 posts

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVE-2026-78535
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T12:17:21.310000

1 posts

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVE-2026-78529
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:20.803000

1 posts

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVE-2026-66569
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:20.693000

1 posts

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVE-2026-105889
(9.3 CRITICAL)

EPSS: 0.26%

updated 2026-10-11T12:16:52.223000

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVE-2026-108540
(9.9 CRITICAL)

EPSS: 1.70%

updated 2026-10-11T09:30:32

1 posts

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108707
(9.8 CRITICAL)

EPSS: 0.55%

updated 2026-10-11T03:30:24

1 posts

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

CVE-2026-108677
(6.5 MEDIUM)

EPSS: 0.23%

updated 2026-10-11T00:31:06

1 posts

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the hard-coded key exposed by /sys/getEncryptedString to obtain administrators' password ciphertexts for offline guessing.

CVE-2026-78530
(7.7 HIGH)

EPSS: 0.40%

updated 2026-10-10T21:31:28

1 posts

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

CVE-2026-66566
(8.1 HIGH)

EPSS: 0.28%

updated 2026-10-10T21:31:28

1 posts

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

CVE-2026-66567
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T21:31:27

1 posts

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVE-2026-78533
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-10T21:31:27

1 posts

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVE-2026-66568
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T21:31:26

1 posts

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVE-2026-96341
(8.2 HIGH)

EPSS: 0.28%

updated 2026-10-10T21:31:20

1 posts

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

CVE-2026-106610
(9.8 CRITICAL)

EPSS: 0.48%

updated 2026-10-10T21:31:15

1 posts

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

1 repos

https://github.com/KevineCharles/CVE-2026-106610-miniorange-otp-ato

CVE-2026-108598
(9.8 CRITICAL)

EPSS: 0.73%

updated 2026-10-10T19:16:58.347000

1 posts

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

CVE-2026-103071
(7.5 HIGH)

EPSS: 0.25%

updated 2026-10-10T18:31:26

1 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVE-2026-108546
(7.5 HIGH)

EPSS: 0.80%

updated 2026-10-10T15:30:30

1 posts

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as

CVE-2026-108553
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-10T15:30:30

1 posts

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

CVE-2026-105885
(8.8 HIGH)

EPSS: 0.29%

updated 2026-10-10T15:30:29

1 posts

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVE-2026-108551
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-10T15:30:29

1 posts

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are importe

CVE-2026-108550
(8.8 HIGH)

EPSS: 0.30%

updated 2026-10-10T15:16:58.133000

1 posts

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens

CVE-2026-108549
(8.1 HIGH)

EPSS: 0.45%

updated 2026-10-10T15:16:58.087000

1 posts

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVE-2026-108161
(7.5 HIGH)

EPSS: 1.10%

updated 2026-10-10T14:16:37.223000

1 posts

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a priv

CVE-2026-96662
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-10T09:30:41

1 posts

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to a

CVE-2026-93936
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVE-2026-93935
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVE-2026-62046
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVE-2026-93934
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVE-2026-93933
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVE-2026-93932
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVE-2026-93931
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVE-2026-93944
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVE-2026-93943
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVE-2026-93942
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVE-2026-93950
(7.5 HIGH)

EPSS: 0.20%

updated 2026-10-10T09:30:37

1 posts

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

CVE-2026-94538
(8.1 HIGH)

EPSS: 0.25%

updated 2026-10-10T09:30:36

1 posts

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, mo

CVE-2026-104759
(8.1 HIGH)

EPSS: 0.52%

updated 2026-10-10T09:30:36

1 posts

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonc

CVE-2026-93930
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:36

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVE-2026-93940
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:36

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVE-2026-84278
(7.2 HIGH)

EPSS: 2.25%

updated 2026-10-10T04:18:18.940000

2 posts

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

CVE-2026-69435
(9.6 CRITICAL)

EPSS: 0.39%

updated 2026-10-10T04:18:13.347000

1 posts

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVE-2026-107406
(0 None)

EPSS: 0.47%

updated 2026-10-10T04:18:09.503000

2 posts

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:   * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37

4 repos

https://github.com/ApexBreach/CVE-2026-107406-Poc

https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker

https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406

https://github.com/ctroy999/CVE-2026-107406

CVE-2026-108474
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T00:30:32

1 posts

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

CVE-2026-108269
(0 None)

EPSS: 0.13%

updated 2026-10-09T22:16:59.793000

1 posts

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before permitting application traffic. An attacker who obtained an enclave TLS private key could relay a genuine q

CVE-2026-108268
(0 None)

EPSS: 0.13%

updated 2026-10-09T22:16:59.643000

1 posts

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote o

CVE-2026-75351
(7.5 HIGH)

EPSS: 0.40%

updated 2026-10-09T21:31:18

1 posts

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

CVE-2026-92705
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-09T21:17:06.360000

1 posts

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file execute

CVE-2026-75346
(7.5 HIGH)

EPSS: 0.54%

updated 2026-10-09T21:17:05.800000

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service

CVE-2026-108261
(9.3 CRITICAL)

EPSS: 0.16%

updated 2026-10-09T21:17:04.347000

1 posts

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the Graph

CVE-2026-108260
(7.6 HIGH)

EPSS: 0.21%

updated 2026-10-09T21:17:04.180000

1 posts

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's

CVE-2026-108259
(8.2 HIGH)

EPSS: 0.25%

updated 2026-10-09T20:56:53

1 posts

### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module. ### Affected component - **Source (branch read):** `packages/@tinacms/cli/src/cmds/init/templat

CVE-2026-62376
(8.1 HIGH)

EPSS: 0.21%

updated 2026-10-09T20:49:15

1 posts

### Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in **plaintext**. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. ### Details `pkg/user/token.go` — `genToken()` st

CVE-2026-107806(CVSS UNKNOWN)

EPSS: 0.33%

updated 2026-10-09T20:45:03

1 posts

## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ## Impact An authenticated user can overwr

1 repos

https://github.com/murrez/CVE-2026-107806

CVE-2026-57458
(8.1 HIGH)

EPSS: 0.27%

updated 2026-10-09T20:40:28

1 posts

## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: ```json {"oauth":["authorize"]} ``` can call `/api/v1/oauth/authorize`, receive an OAuth authorization code, exchange it at `/api/v1/oauth/token`, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not rest

CVE-2026-108160
(7.5 HIGH)

EPSS: 0.15%

updated 2026-10-09T20:17:10.767000

1 posts

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the d

CVE-2026-107845
(9.3 CRITICAL)

EPSS: 0.27%

updated 2026-10-09T20:17:10.457000

1 posts

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under th

CVE-2026-107840
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T20:17:09.900000

1 posts

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacke

CVE-2026-103413
(8.8 HIGH)

EPSS: 0.39%

updated 2026-10-09T18:32:43

1 posts

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan

CVE-2026-75350
(7.5 HIGH)

EPSS: 0.48%

updated 2026-10-09T18:31:52

1 posts

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

CVE-2026-108113
(8.8 HIGH)

EPSS: 0.64%

updated 2026-10-09T18:31:48

1 posts

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u

CVE-2026-75349
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:31:48

1 posts

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

CVE-2026-104084
(8.8 HIGH)

EPSS: 0.25%

updated 2026-10-09T18:31:47

1 posts

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the

1 repos

https://github.com/eev4n/smartermail

CVE-2026-90983
(8.2 HIGH)

EPSS: 0.26%

updated 2026-10-09T18:31:47

1 posts

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.

CVE-2026-108157
(8.1 HIGH)

EPSS: 0.53%

updated 2026-10-09T18:31:44

1 posts

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the vi

CVE-2026-78795
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:17:14.903000

1 posts

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVE-2026-75348
(7.5 HIGH)

EPSS: 0.51%

updated 2026-10-09T18:17:13.893000

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed s

CVE-2026-108109
(9.1 CRITICAL)

EPSS: 0.39%

updated 2026-10-09T18:17:06.727000

1 posts

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-107839
(7.5 HIGH)

EPSS: 0.34%

updated 2026-10-09T18:17:05.797000

1 posts

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remot

CVE-2026-107838
(7.5 HIGH)

EPSS: 0.34%

updated 2026-10-09T18:17:05.640000

1 posts

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. From version 2023.07 through version 2026.07, nanocoap_fileserver callers in sys/net/application_layer/nanocoap/fileserver.c ignore a failure returned by _resp_init() when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoA

CVE-2026-107837
(8.2 HIGH)

EPSS: 0.38%

updated 2026-10-09T18:17:05.483000

1 posts

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys/net/gnrc/network_layer/sixlowpan/gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. The code then interprets the packet as a sixlowpan_frag_t or larger fragment header withou

CVE-2026-107821
(8.0 HIGH)

EPSS: 0.48%

updated 2026-10-09T18:17:03.860000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or pot

CVE-2026-107808
(8.1 HIGH)

EPSS: 0.41%

updated 2026-10-09T18:17:02.773000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the pa

CVE-2026-108159
(7.5 HIGH)

EPSS: 0.33%

updated 2026-10-09T17:41:47.060000

1 posts

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu

CVE-2026-75347
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-09T17:41:47.060000

1 posts

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.

CVE-2026-107815
(8.5 HIGH)

EPSS: 0.57%

updated 2026-10-09T17:41:29.727000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code e

CVE-2026-107826
(7.5 HIGH)

EPSS: 0.46%

updated 2026-10-09T17:33:55

1 posts

### Summary The JSON body processor (`internal/bodyprocessors/json.go`) can be made to crash the whole process with an unrecoverable `fatal error: stack overflow`, using a request body that is well under the recommended `SecRequestBodyLimit` and the default `SecArgumentsLimit`. ### Root cause `readJSON` (json.go:113-143) runs a bounded, best-effort flattening walk (`readItems`) and *afterwards*

CVE-2026-107814
(8.4 HIGH)

EPSS: 0.28%

updated 2026-10-09T17:16:45.853000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an a

CVE-2026-107812
(7.5 HIGH)

EPSS: 0.17%

updated 2026-10-09T17:08:21

1 posts

## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the SAME endpoint (`version.GetUrl()`, which is `github_proxy` or, by default, the project's `cloud.nginxui.com` mirror), and verifies the binary ONLY by comparing it to that digest: `digestFileContent == DigestSHA512(tarName)`. Both the binary and the digest come from the same orig

CVE-2026-107809
(8.8 HIGH)

EPSS: 0.18%

updated 2026-10-09T17:08:11

1 posts

## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source. Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests. The atta

CVE-2026-107813
(8.8 HIGH)

EPSS: 0.30%

updated 2026-10-09T17:08:07

1 posts

## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up. An authenticated user whose JWT is stolen or persisted, but who does not hold

CVE-2026-75345
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T17:07:31.693000

1 posts

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.

CVE-2026-107807
(8.8 HIGH)

EPSS: 0.31%

updated 2026-10-09T17:07:11

1 posts

## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configur

CVE-2026-108106
(7.5 HIGH)

EPSS: 0.37%

updated 2026-10-09T17:06:17.770000

1 posts

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service

CVE-2026-107805
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume tempo

CVE-2026-107811
(8.8 HIGH)

EPSS: 0.36%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node auth

CVE-2026-107810
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes

CVE-2026-55797
(8.8 HIGH)

EPSS: 1.55%

updated 2026-10-09T16:37:27

1 posts

### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and ear