CVE-2026-19935
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-11T18:16:59.410000

2 posts

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a struct k_work embedded in the channel object (le_chan->rx_work, handler l2cap_rx_process()) whenever the channel uses a dynamic PSM (0x0080-0x00FF). Channel teardown in l2cap_chan_destroy() in subsys/bluetooth/host/l2cap.c cancels the retransmission-timeout work and drains the RX FI

CVE-2026-19736
(7.8 HIGH)

EPSS: 0.00%

updated 2026-10-11T18:16:58.810000

2 posts

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData(). On i.MX RT5xx and RT6xx parts the SDK compiles its TRNG_SW_HEALTH_TESTS variant, which always copies whole 32-bit words and draws entropy rounded up to a multiple of 128 bytes. Its "caller buffer is full" guard tests dataSize == 0, so a req

CVE-2026-19669
(7.8 HIGH)

EPSS: 0.00%

updated 2026-10-11T18:16:58.563000

2 posts

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fuel_gauge_syscall_handlers.c declared two variable-length arrays, union fuel_gauge_prop_val k_vals[len] and fuel_gauge_prop_t k_props[len], sized directly by the caller-supplied len argument. len is an unvalidated size_t taken straight from the syscall ABI, and the VLAs were alloc

CVE-2026-91136
(7.5 HIGH)

EPSS: 0.56%

updated 2026-10-11T17:17:07.010000

1 posts

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — san

CVE-2026-33367
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-11T17:17:04.760000

1 posts

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVE-2026-28745
(7.5 HIGH)

EPSS: 0.22%

updated 2026-10-11T17:17:04.303000

1 posts

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

CVE-2026-105281
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-11T17:17:01.723000

1 posts

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CVE-2026-104759
(8.1 HIGH)

EPSS: 0.52%

updated 2026-10-11T17:17:00.237000

1 posts

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonc

CVE-2026-96341
(8.2 HIGH)

EPSS: 0.28%

updated 2026-10-11T13:17:29.907000

1 posts

Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

CVE-2026-93944
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T13:17:28.283000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVE-2026-93943
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T13:17:28.180000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVE-2026-93940
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:27.850000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVE-2026-93937
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-11T13:17:27.643000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVE-2026-93934
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T13:17:27.323000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVE-2026-93932
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T13:17:27.100000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVE-2026-93931
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T13:17:26.997000

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVE-2026-62045
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T13:17:24.780000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVE-2026-108753
(9.4 CRITICAL)

EPSS: 0.00%

updated 2026-10-11T13:17:20.237000

2 posts

Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or sign their own JWT with admin: true to impersonate users, reset passwords, and change server configuration.

CVE-2026-106610
(9.8 CRITICAL)

EPSS: 0.48%

updated 2026-10-11T13:17:12.430000

2 posts

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

1 repos

https://github.com/KevineCharles/CVE-2026-106610-miniorange-otp-ato

CVE-2026-105892
(9.8 CRITICAL)

EPSS: 0.42%

updated 2026-10-11T13:17:11.910000

1 posts

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

CVE-2026-104398
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T13:17:11.270000

2 posts

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVE-2026-103071
(7.5 HIGH)

EPSS: 0.25%

updated 2026-10-11T13:17:10.180000

1 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVE-2026-93550
(4.3 MEDIUM)

EPSS: 0.14%

updated 2026-10-11T12:32:13

2 posts

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above to make the Veeqo for WooCommerce WordPress plugin through 2.2.8 download and extract an attacker-controlled archive containing arbitrary PHP file

CVE-2026-96227
(8.8 HIGH)

EPSS: 0.17%

updated 2026-10-11T12:32:13

2 posts

The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary JavaScript in the site's origin when it is opened (Stored XSS).

CVE-2026-86717
(9.1 CRITICAL)

EPSS: 0.15%

updated 2026-10-11T12:17:24.653000

2 posts

The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline and strip every user of their role.

CVE-2026-81797
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-11T12:17:22.500000

1 posts

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

CVE-2026-78535
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T12:17:21.310000

1 posts

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

CVE-2026-78533
(9.8 CRITICAL)

EPSS: 0.34%

updated 2026-10-11T12:17:21.103000

1 posts

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

CVE-2026-66569
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:20.693000

1 posts

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

CVE-2026-66568
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-11T12:17:20.590000

1 posts

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

CVE-2026-108540
(9.9 CRITICAL)

EPSS: 1.70%

updated 2026-10-11T09:30:32

2 posts

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-108707
(9.8 CRITICAL)

EPSS: 0.55%

updated 2026-10-11T03:30:24

2 posts

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

CVE-2026-78530
(7.7 HIGH)

EPSS: 0.40%

updated 2026-10-10T21:31:28

1 posts

Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

CVE-2026-78529
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T21:31:28

1 posts

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

CVE-2026-66566
(8.1 HIGH)

EPSS: 0.28%

updated 2026-10-10T21:31:28

1 posts

Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

CVE-2026-66567
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T21:31:27

1 posts

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

CVE-2026-108598
(9.8 CRITICAL)

EPSS: 0.73%

updated 2026-10-10T21:31:20

1 posts

Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

CVE-2026-106609
(7.5 HIGH)

EPSS: 0.22%

updated 2026-10-10T18:31:27

1 posts

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

CVE-2026-105889
(9.3 CRITICAL)

EPSS: 0.26%

updated 2026-10-10T18:31:27

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVE-2026-108546
(7.5 HIGH)

EPSS: 0.80%

updated 2026-10-10T15:30:30

1 posts

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as

CVE-2026-105885
(8.8 HIGH)

EPSS: 0.29%

updated 2026-10-10T15:30:29

1 posts

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVE-2026-108550
(8.8 HIGH)

EPSS: 0.30%

updated 2026-10-10T15:30:24

1 posts

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens

CVE-2026-108161
(7.5 HIGH)

EPSS: 1.10%

updated 2026-10-10T15:30:22

1 posts

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a priv

CVE-2026-108553
(7.5 HIGH)

EPSS: 0.18%

updated 2026-10-10T15:16:58.410000

1 posts

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

CVE-2026-108551
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-10T15:16:58.273000

1 posts

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are importe

CVE-2026-108549
(8.1 HIGH)

EPSS: 0.45%

updated 2026-10-10T15:16:58.087000

1 posts

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVE-2026-19494
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-10T13:17:32.163000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

CVE-2026-96662
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-10T09:30:41

1 posts

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to a

CVE-2026-93936
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVE-2026-93945
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:37

3 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVE-2026-93935
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVE-2026-62046
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T09:30:37

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVE-2026-104803
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-10-10T09:30:37

2 posts

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i

CVE-2026-93933
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVE-2026-93929
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVE-2026-93942
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVE-2026-93941
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVE-2026-93938
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T09:30:37

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVE-2026-93950
(7.5 HIGH)

EPSS: 0.20%

updated 2026-10-10T09:30:37

1 posts

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

CVE-2026-94538
(8.1 HIGH)

EPSS: 0.25%

updated 2026-10-10T09:30:36

1 posts

The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete any file managed by WP File Download, empty the entire trash, mo

CVE-2026-93746
(7.5 HIGH)

EPSS: 0.53%

updated 2026-10-10T09:30:36

1 posts

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents

CVE-2026-93930
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T09:30:36

1 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVE-2026-93927
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T09:30:36

1 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.

CVE-2026-97670
(9.1 CRITICAL)

EPSS: 0.37%

updated 2026-10-10T06:31:08

1 posts

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data toke

CVE-2026-94589
(9.8 CRITICAL)

EPSS: 0.66%

updated 2026-10-10T06:31:06

1 posts

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload

CVE-2026-88131
(9.8 CRITICAL)

EPSS: 0.84%

updated 2026-10-10T04:18:19.240000

2 posts

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

CVE-2026-84875
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-10T04:18:19.087000

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84035
(8.1 HIGH)

EPSS: 0.37%

updated 2026-10-10T04:18:17.220000

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

CVE-2026-77900
(9.8 CRITICAL)

EPSS: 0.49%

updated 2026-10-10T04:18:14.030000

2 posts

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

CVE-2026-69435
(9.6 CRITICAL)

EPSS: 0.39%

updated 2026-10-10T04:18:13.347000

2 posts

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVE-2026-107406
(0 None)

EPSS: 0.47%

updated 2026-10-10T04:18:09.503000

10 posts

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:   * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37

4 repos

https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406

https://github.com/ctroy999/CVE-2026-107406

https://github.com/ApexBreach/CVE-2026-107406-Poc

https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker

CVE-2026-108474
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T00:17:03.673000

1 posts

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

CVE-2026-108268
(0 None)

EPSS: 0.13%

updated 2026-10-09T22:16:59.643000

1 posts

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote o

CVE-2026-75351
(7.5 HIGH)

EPSS: 0.40%

updated 2026-10-09T21:31:18

1 posts

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

CVE-2026-75346
(7.5 HIGH)

EPSS: 0.54%

updated 2026-10-09T21:17:05.800000

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service

CVE-2026-62376
(8.1 HIGH)

EPSS: 0.21%

updated 2026-10-09T21:17:05.627000

1 posts

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing

CVE-2026-57458
(8.1 HIGH)

EPSS: 0.27%

updated 2026-10-09T21:17:05.190000

1 posts

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the `oauth.authorize` permission can call `POST /api/v1/oauth/authorize`, obtain an OAuth authorization code, and exchange the code at `POST /api/v1/oauth/token` for a normal bearer JSON Web Token (JWT) and refresh token. The resulting credentials are not restricted by the original API t

CVE-2026-108264
(9.1 CRITICAL)

EPSS: 0.38%

updated 2026-10-09T21:17:04.703000

1 posts

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator

CVE-2026-108263
(9.9 CRITICAL)

EPSS: 0.43%

updated 2026-10-09T21:17:04.527000

1 posts

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the docu

CVE-2026-108259
(8.2 HIGH)

EPSS: 0.25%

updated 2026-10-09T20:56:53

1 posts

### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module. ### Affected component - **Source (branch read):** `packages/@tinacms/cli/src/cmds/init/templat

CVE-2026-108261
(9.3 CRITICAL)

EPSS: 0.16%

updated 2026-10-09T20:56:50

1 posts

### Summary The TinaCMS admin builds its preview `<iframe src>` from the `/~/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#/~//attacker.example/p`) becomes the protocol-relative URL `//attacker.example/p`, so the admin frames an external site. That same unvalidated string derives `expectedOrigin`, the only trust anchor for the admin↔pre

CVE-2026-108260
(7.6 HIGH)

EPSS: 0.21%

updated 2026-10-09T20:56:46

1 posts

### Summary `<tina-markdown>` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's `href` with no scheme check. A link authored in the CMS as `javascript:…` renders as a live `javascript:` anchor, so a visitor who clicks it executes attacker-supplied script in the site's origin. Every sibling renderer in the repository already sanitizes these UR

CVE-2026-107845
(9.3 CRITICAL)

EPSS: 0.27%

updated 2026-10-09T20:53:52

1 posts

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No `Content-Security-Policy` header is sent on the Contao back end, so nothing mitigates the inline handler. ### Impact Anyone on the internet can inject script that executes in the Cont

CVE-2026-107806(CVSS UNKNOWN)

EPSS: 0.33%

updated 2026-10-09T20:45:03

1 posts

## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ## Impact An authenticated user can overwr

1 repos

https://github.com/murrez/CVE-2026-107806

CVE-2026-107840
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T20:17:09.900000

1 posts

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacke

CVE-2026-104084
(8.8 HIGH)

EPSS: 0.25%

updated 2026-10-09T20:17:09.050000

1 posts

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the

CVE-2026-103412
(8.8 HIGH)

EPSS: 0.52%

updated 2026-10-09T18:32:43

1 posts

Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any locat

CVE-2026-75350
(7.5 HIGH)

EPSS: 0.48%

updated 2026-10-09T18:31:52

1 posts

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

CVE-2026-108113
(8.8 HIGH)

EPSS: 0.64%

updated 2026-10-09T18:31:48

1 posts

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u

CVE-2026-108160
(7.5 HIGH)

EPSS: 0.15%

updated 2026-10-09T18:31:48

1 posts

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the d

CVE-2026-108159
(7.5 HIGH)

EPSS: 0.33%

updated 2026-10-09T18:31:48

1 posts

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu

CVE-2026-75345
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:31:47

1 posts

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.

CVE-2026-90983
(8.2 HIGH)

EPSS: 0.26%

updated 2026-10-09T18:31:47

1 posts

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.

CVE-2026-78795
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:31:42

1 posts

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVE-2026-75348
(7.5 HIGH)

EPSS: 0.51%

updated 2026-10-09T18:17:13.893000

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed s

CVE-2026-108157
(8.1 HIGH)

EPSS: 0.53%

updated 2026-10-09T18:17:07.240000

1 posts

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the vi

CVE-2026-107839
(7.5 HIGH)

EPSS: 0.34%

updated 2026-10-09T18:17:05.797000

1 posts

ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server has no request body size limit or cap on the attacker-controlled JSON names array and allocates response storage directly from the unbounded array length. A remot

CVE-2026-107818
(8.4 HIGH)

EPSS: 0.34%

updated 2026-10-09T18:17:03.373000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment

CVE-2026-107808
(8.1 HIGH)

EPSS: 0.41%

updated 2026-10-09T18:17:02.773000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2FA reporting that the account has a second factor. An attacker who obtains the pa

CVE-2026-107807
(8.8 HIGH)

EPSS: 0.31%

updated 2026-10-09T18:17:02.610000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment

CVE-2026-75347
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-09T17:41:47.060000

1 posts

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.

CVE-2026-107815
(8.5 HIGH)

EPSS: 0.57%

updated 2026-10-09T17:41:29.727000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code e

CVE-2026-107826
(7.5 HIGH)

EPSS: 0.46%

updated 2026-10-09T17:33:55

1 posts

### Summary The JSON body processor (`internal/bodyprocessors/json.go`) can be made to crash the whole process with an unrecoverable `fatal error: stack overflow`, using a request body that is well under the recommended `SecRequestBodyLimit` and the default `SecArgumentsLimit`. ### Root cause `readJSON` (json.go:113-143) runs a bounded, best-effort flattening walk (`readItems`) and *afterwards*

CVE-2026-107814
(8.4 HIGH)

EPSS: 0.28%

updated 2026-10-09T17:16:45.853000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an a

CVE-2026-107812
(7.5 HIGH)

EPSS: 0.17%

updated 2026-10-09T17:08:21

1 posts

## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the SAME endpoint (`version.GetUrl()`, which is `github_proxy` or, by default, the project's `cloud.nginxui.com` mirror), and verifies the binary ONLY by comparing it to that digest: `digestFileContent == DigestSHA512(tarName)`. Both the binary and the digest come from the same orig

CVE-2026-107809
(8.8 HIGH)

EPSS: 0.18%

updated 2026-10-09T17:08:11

1 posts

## Summary Nginx-UI v2.4.3 stores the API JWT in a browser cookie named `token` and the `AuthRequired` middleware accepts that cookie as an authentication source. Because management endpoints are protected by `AuthRequired` and do not enforce a universal CSRF token or Origin/Referer check, a remote attacker can induce a logged-in administrator to submit cross-site state-changing requests. The atta

CVE-2026-107813
(8.8 HIGH)

EPSS: 0.30%

updated 2026-10-09T17:08:07

1 posts

## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up. An authenticated user whose JWT is stolen or persisted, but who does not hold

CVE-2026-107810
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T17:07:06

1 posts

### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both `restore_nginx` and `restore_nginx_ui` are set to `false`. ### Details The restore flow always extracts the outer archive, verifies the manifest, decrypts `nginx-ui.zi

CVE-2026-108106
(7.5 HIGH)

EPSS: 0.37%

updated 2026-10-09T17:06:17.770000

1 posts

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service

CVE-2026-75349
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T16:40:29.800000

1 posts

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

CVE-2026-107805
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume tempo

CVE-2026-107811
(8.8 HIGH)

EPSS: 0.36%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node auth

CVE-2026-55797
(8.8 HIGH)

EPSS: 1.55%

updated 2026-10-09T16:37:27

1 posts

### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and ear

CVE-2026-103413
(8.8 HIGH)

EPSS: 0.39%

updated 2026-10-09T16:33:39.007000

1 posts

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan

CVE-2026-93947
(9.3 CRITICAL)

EPSS: 0.24%

updated 2026-10-09T16:17:32.090000

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVE-2026-79842
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-09T15:32:29

2 posts

An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713

CVE-2026-39460
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-09T15:31:42

1 posts

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

CVE-2026-108101
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-09T15:31:38

1 posts

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVE-2026-100730
(9.8 CRITICAL)

EPSS: 0.62%

updated 2026-10-09T15:31:37

1 posts

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which c

CVE-2026-15340
(9.8 CRITICAL)

EPSS: 0.60%

updated 2026-10-09T15:31:35

1 posts

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVE-2026-39453
(8.3 HIGH)

EPSS: 0.29%

updated 2026-10-09T15:31:35

1 posts

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.

CVE-2026-108107
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-09T15:31:34

1 posts

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108109
(9.1 CRITICAL)

EPSS: 0.39%

updated 2026-10-09T15:31:34

1 posts

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-83943
(8.7 HIGH)

EPSS: 0.38%

updated 2026-10-09T15:31:32

1 posts

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.

CVE-2016-3081
(8.1 HIGH)

EPSS: 96.05%

updated 2026-10-09T14:43:05.703000

2 posts

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

CVE-2026-11318
(7.8 HIGH)

EPSS: 0.19%

updated 2026-10-09T14:17:20.393000

1 posts

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the

1 repos

https://github.com/Cr0wld3r/CVE-2026-11318

CVE-2026-17189
(8.2 HIGH)

EPSS: 0.15%

updated 2026-10-09T14:15:54.050000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

CVE-2026-19493
(7.5 HIGH)

EPSS: 0.36%

updated 2026-10-09T14:15:19.050000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal.

CVE-2026-86405
(9.8 CRITICAL)

EPSS: 0.20%

updated 2026-10-09T13:21:13.267000

1 posts

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

CVE-2026-94503
(10.0 CRITICAL)

EPSS: 0.28%

updated 2026-10-09T12:31:48

1 posts

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

1 repos

https://github.com/Wayang1337/CVE-2026-94503

CVE-2026-96207
(10.0 CRITICAL)

EPSS: 0.48%

updated 2026-10-09T00:31:56

2 posts

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-94510
(9.9 CRITICAL)

EPSS: 0.40%

updated 2026-10-09T00:31:56

2 posts

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-83947
(7.7 HIGH)

EPSS: 0.37%

updated 2026-10-09T00:31:56

1 posts

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

CVE-2026-84058
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.

CVE-2026-84057
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-84249
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVE-2026-89091
(8.8 HIGH)

EPSS: 0.48%

updated 2026-10-09T00:31:56

1 posts

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink di

CVE-2026-107782
(7.8 HIGH)

EPSS: 0.11%

updated 2026-10-08T21:34:48.800000

1 posts

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

CVE-2026-19482
(8.8 HIGH)

EPSS: 0.42%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.

CVE-2026-16823
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

CVE-2026-19491
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

CVE-2026-78406
(9.8 CRITICAL)

EPSS: 0.50%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-78401
(9.8 CRITICAL)

EPSS: 0.57%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-18740
(8.8 HIGH)

EPSS: 0.35%

updated 2026-10-08T21:33:41

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.

CVE-2026-16916
(9.1 CRITICAL)

EPSS: 0.42%

updated 2026-10-08T21:33:41

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

CVE-2026-107779
(9.8 CRITICAL)

EPSS: 0.54%

updated 2026-10-08T21:27:15.010000

1 posts

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor ho

CVE-2026-20362
(7.2 HIGH)

EPSS: 0.47%

updated 2026-10-08T20:08:45.857000

1 posts

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successfu

CVE-2026-103663(CVSS UNKNOWN)