CVE-2026-106609
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-10T18:31:27

2 posts

Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

CVE-2026-105889
(9.3 CRITICAL)

EPSS: 0.00%

updated 2026-10-10T18:31:27

2 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

CVE-2026-103071
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-10T18:31:26

2 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

CVE-2026-104398
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-10-10T17:16:59.937000

2 posts

Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

CVE-2026-108546
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-10T15:30:30

2 posts

Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as

CVE-2026-105885
(8.8 HIGH)

EPSS: 0.00%

updated 2026-10-10T15:30:29

2 posts

Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

CVE-2026-108549
(8.1 HIGH)

EPSS: 0.00%

updated 2026-10-10T15:30:29

2 posts

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

CVE-2026-108551
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-10-10T15:30:29

2 posts

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are importe

CVE-2026-108550
(8.8 HIGH)

EPSS: 0.00%

updated 2026-10-10T15:30:24

2 posts

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens

CVE-2026-108553
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-10T15:16:58.410000

2 posts

OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

CVE-2026-108161
(7.5 HIGH)

EPSS: 0.00%

updated 2026-10-10T14:16:37.223000

2 posts

FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a priv

CVE-2026-104803
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-10-10T09:30:37

2 posts

The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters of the social-login callback handler registered on the `init` hook. The vulnerability exists because the `login` function's social-login flow performs no nonce validation, no OAuth state verification, and no per-visitor namespace isolation i

CVE-2026-91136
(7.5 HIGH)

EPSS: 0.56%

updated 2026-10-10T09:16:39.360000

2 posts

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — san

CVE-2026-96662
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-10T08:17:08.033000

2 posts

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to a

CVE-2026-93950
(7.5 HIGH)

EPSS: 0.20%

updated 2026-10-10T08:17:07.307000

2 posts

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

CVE-2026-93945
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:07.057000

4 posts

Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.

CVE-2026-93944
(9.8 CRITICAL)

EPSS: 0.31%

updated 2026-10-10T08:17:06.930000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVE-2026-93941
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:06.557000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVE-2026-93940
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:06.433000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVE-2026-93938
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:06.310000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVE-2026-93937
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:06.187000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVE-2026-93936
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T08:17:06.060000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVE-2026-62046
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T08:17:04.777000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVE-2026-62045
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T08:17:04.647000

2 posts

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVE-2026-97670
(9.1 CRITICAL)

EPSS: 0.37%

updated 2026-10-10T06:31:08

1 posts

The Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field value (via the notification email_message [field] placeholder and the {action_hook,...} dynamic-data toke

CVE-2026-94589
(9.8 CRITICAL)

EPSS: 0.66%

updated 2026-10-10T06:31:06

1 posts

The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.4.5 via the extcf7_submit function. This is due to missing file extension, MIME type, and size validation in the signature field's validation_filter(), combined with the absence of PHP-execution guards in the upload

CVE-2026-96207
(10.0 CRITICAL)

EPSS: 0.48%

updated 2026-10-10T04:18:19.870000

2 posts

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-94510
(9.9 CRITICAL)

EPSS: 0.40%

updated 2026-10-10T04:18:19.577000

2 posts

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-84249
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-10T04:18:18.437000

1 posts

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

CVE-2026-84058
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-10T04:18:17.540000

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a network monitored by an IBM Guardium Collector may cause a denial of service or potentially execute arbitrary code on the Collector appliance.

CVE-2026-82344
(8.1 HIGH)

EPSS: 0.40%

updated 2026-10-10T04:18:16.730000

1 posts

IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.

CVE-2026-78406
(9.8 CRITICAL)

EPSS: 0.50%

updated 2026-10-10T04:18:15.970000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-18740
(8.8 HIGH)

EPSS: 0.35%

updated 2026-10-10T04:18:12.470000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.

CVE-2026-16823
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-10T04:18:12.110000

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

CVE-2026-108474
(9.8 CRITICAL)

EPSS: 0.32%

updated 2026-10-10T00:17:03.673000

1 posts

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

CVE-2026-108268
(0 None)

EPSS: 0.13%

updated 2026-10-09T22:16:59.643000

1 posts

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote o

CVE-2026-75351
(7.5 HIGH)

EPSS: 0.40%

updated 2026-10-09T21:31:18

1 posts

OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

CVE-2026-75346
(7.5 HIGH)

EPSS: 0.54%

updated 2026-10-09T21:31:17

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributeList service. This allows a remote attacker to cause a denial of service

CVE-2026-92705
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-09T21:17:06.360000

1 posts

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by `Automation Scripts` metadata in `ASS` subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted `ASS` file together with a referenced malicious Automation script, and opening the `AS`  file execute

CVE-2026-108264
(9.1 CRITICAL)

EPSS: 0.38%

updated 2026-10-09T21:17:04.703000

1 posts

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator

CVE-2026-108259
(8.2 HIGH)

EPSS: 0.25%

updated 2026-10-09T21:17:04.017000

1 posts

Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name c

CVE-2026-107805
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T20:57:10

1 posts

## Summary In Nginx UI versions 2.5.0 through 2.5.x, the node-signature authentication path staged an attacker-controlled request body in a temporary file and synchronized it to disk before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API can provide syntactically valid signature metadata and cause storage and I/O consumption before t

CVE-2026-108261
(9.3 CRITICAL)

EPSS: 0.16%

updated 2026-10-09T20:56:50

1 posts

### Summary The TinaCMS admin builds its preview `<iframe src>` from the `/~/*` hash-router splat without checking that the value stays same-origin. A fragment with a doubled slash (`#/~//attacker.example/p`) becomes the protocol-relative URL `//attacker.example/p`, so the admin frames an external site. That same unvalidated string derives `expectedOrigin`, the only trust anchor for the admin↔pre

CVE-2026-108260
(7.6 HIGH)

EPSS: 0.21%

updated 2026-10-09T20:56:46

1 posts

### Summary `<tina-markdown>` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's `href` with no scheme check. A link authored in the CMS as `javascript:…` renders as a live `javascript:` anchor, so a visitor who clicks it executes attacker-supplied script in the site's origin. Every sibling renderer in the repository already sanitizes these UR

CVE-2026-107845
(9.3 CRITICAL)

EPSS: 0.27%

updated 2026-10-09T20:53:52

1 posts

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No `Content-Security-Policy` header is sent on the Contao back end, so nothing mitigates the inline handler. ### Impact Anyone on the internet can inject script that executes in the Cont

CVE-2026-62376
(8.1 HIGH)

EPSS: 0.21%

updated 2026-10-09T20:49:15

1 posts

### Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the `user_tokens` table in **plaintext**. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over user accounts without knowing passwords. ### Details `pkg/user/token.go` — `genToken()` st

CVE-2026-107806(CVSS UNKNOWN)

EPSS: 0.33%

updated 2026-10-09T20:45:03

1 posts

## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ## Impact An authenticated user can overwr

1 repos

https://github.com/murrez/CVE-2026-107806

CVE-2026-107839
(7.5 HIGH)

EPSS: 0.34%

updated 2026-10-09T20:44:55

1 posts

### Summary The AoE3 `POST /game/cloud/getFileURL` handler in `luskaner/ageLANServer`'s bundled game server decodes an attacker-controlled `names` JSON array and immediately allocates response storage sized directly from the array's length (`make(i.A, len(req.Names.Data))`), with no request body size limit and no cap on the number of array elements anywhere in the request path. Because the default

CVE-2026-57458
(8.1 HIGH)

EPSS: 0.27%

updated 2026-10-09T20:40:28

1 posts

## Summary A scoped API token can bypass its declared permissions by using the OAuth authorization flow to mint normal session credentials. A token limited to: ```json {"oauth":["authorize"]} ``` can call `/api/v1/oauth/authorize`, receive an OAuth authorization code, exchange it at `/api/v1/oauth/token`, and obtain a normal bearer JWT plus refresh token. The resulting credentials are not rest

CVE-2026-107840
(7.5 HIGH)

EPSS: 0.44%

updated 2026-10-09T20:17:09.900000

1 posts

yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopass_http_requests_total and yopass_http_request_duration_seconds. Because the catch-all route accepts arbitrary HTTP method tokens, an unauthenticated remote attacke

CVE-2026-103413
(8.8 HIGH)

EPSS: 0.39%

updated 2026-10-09T18:32:43

1 posts

Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernetes.yaml` and applied every resource it contained to the cluster without restricting the resource kinds, without rejecting security-sensitive pod options, and without pinning the target namespace. An authenticated user of any role could therefore have Karavan

CVE-2026-75347
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-09T18:31:53

1 posts

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.

CVE-2026-108113
(8.8 HIGH)

EPSS: 0.64%

updated 2026-10-09T18:31:48

1 posts

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can import a crafted archive writing a .htaccess and PHP file to the web-served image directory, achieving remote code execution as the web server u

CVE-2026-75349
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:31:48

1 posts

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

CVE-2026-108160
(7.5 HIGH)

EPSS: 0.15%

updated 2026-10-09T18:31:48

1 posts

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the d

CVE-2026-104084
(8.8 HIGH)

EPSS: 0.25%

updated 2026-10-09T18:31:47

1 posts

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. Attackers who capture a refresh token issued before an administrator demotion, or a demoted user whose session was not actively polling at the

CVE-2026-75345
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:31:47

1 posts

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service.

CVE-2026-90983
(8.2 HIGH)

EPSS: 0.26%

updated 2026-10-09T18:31:47

1 posts

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0.

CVE-2026-108157
(8.1 HIGH)

EPSS: 0.53%

updated 2026-10-09T18:31:44

1 posts

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.signUp(). Attackers can register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the vi

CVE-2026-78795
(7.5 HIGH)

EPSS: 0.45%

updated 2026-10-09T18:17:14.903000

1 posts

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVE-2026-75350
(7.5 HIGH)

EPSS: 0.48%

updated 2026-10-09T18:17:14.037000

1 posts

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

CVE-2026-75348
(7.5 HIGH)

EPSS: 0.51%

updated 2026-10-09T18:17:13.893000

1 posts

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Common Packet Format parser. The issue occurs in CreateCommonPacketFormatStructure() when it parses recognized optional socket address information items of type 0x8000 or 0x8001 without first validating that the remaining CPF buffer contains the complete fixed s

CVE-2026-107818
(8.4 HIGH)

EPSS: 0.34%

updated 2026-10-09T18:17:03.373000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment

CVE-2026-108159
(7.5 HIGH)

EPSS: 0.33%

updated 2026-10-09T17:41:47.060000

1 posts

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, execu

CVE-2026-107815
(8.5 HIGH)

EPSS: 0.57%

updated 2026-10-09T17:41:29.727000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code e

CVE-2026-107826
(7.5 HIGH)

EPSS: 0.46%

updated 2026-10-09T17:33:55

1 posts

### Summary The JSON body processor (`internal/bodyprocessors/json.go`) can be made to crash the whole process with an unrecoverable `fatal error: stack overflow`, using a request body that is well under the recommended `SecRequestBodyLimit` and the default `SecArgumentsLimit`. ### Root cause `readJSON` (json.go:113-143) runs a bounded, best-effort flattening walk (`readItems`) and *afterwards*

CVE-2026-15340
(9.8 CRITICAL)

EPSS: 0.60%

updated 2026-10-09T17:29:33.410000

1 posts

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVE-2026-107814
(8.4 HIGH)

EPSS: 0.28%

updated 2026-10-09T17:16:45.853000

1 posts

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an a

CVE-2026-107809
(8.8 HIGH)

EPSS: 0.18%

updated 2026-10-09T17:16:45.730000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenti

CVE-2026-107812
(7.5 HIGH)

EPSS: 0.17%

updated 2026-10-09T17:08:21

1 posts

## Summary The self-upgrade downloads the release binary and its checksum (`*.tar.gz` and `*.tar.gz.digest`) through the SAME endpoint (`version.GetUrl()`, which is `github_proxy` or, by default, the project's `cloud.nginxui.com` mirror), and verifies the binary ONLY by comparing it to that digest: `digestFileContent == DigestSHA512(tarName)`. Both the binary and the digest come from the same orig

CVE-2026-107808
(8.1 HIGH)

EPSS: 0.41%

updated 2026-10-09T17:08:16

1 posts

## Summary nginx-ui supports two second-factor methods — TOTP (OTP) and WebAuthn passkeys — and reports an account as 2FA-enabled when **either** is configured. However, the password login endpoint (`POST /api/login`) only enforces a second factor when a **TOTP secret** is present. An account that has registered a **passkey but no TOTP** is logged in after password verification alone — the passke

CVE-2026-107813
(8.8 HIGH)

EPSS: 0.30%

updated 2026-10-09T17:08:07

1 posts

## Summary Incomplete fix of GHSA-5v7c-xpfp-p65m: the secure-session (OTP step-up) requirement added to the nginx, cert, dns, backup, site, and stream mutation routers was not applied to the parallel api/cluster router, so cluster node management and cluster-wide nginx reload/restart run with only a JWT and no step-up. An authenticated user whose JWT is stolen or persisted, but who does not hold

CVE-2026-107807
(8.8 HIGH)

EPSS: 0.31%

updated 2026-10-09T17:07:11

1 posts

## 1. Vulnerability Summary nginx-ui's `Node.Secret` is a master credential that bypasses all JWT/password authentication for the entire API. The application accepts this credential via a **URL query parameter** (`?node_secret=`), causing it to be recorded in plaintext in HTTP access logs, reverse proxy logs, browser history, and HTTP `Referer` headers. Additionally, the official cluster configur

CVE-2026-107810
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T17:07:06

1 posts

### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both `restore_nginx` and `restore_nginx_ui` are set to `false`. ### Details The restore flow always extracts the outer archive, verifies the manifest, decrypts `nginx-ui.zi

CVE-2026-108106
(7.5 HIGH)

EPSS: 0.37%

updated 2026-10-09T17:06:17.770000

1 posts

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service

CVE-2026-100730
(9.8 CRITICAL)

EPSS: 0.62%

updated 2026-10-09T16:41:53.540000

1 posts

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which c

CVE-2026-107811
(8.8 HIGH)

EPSS: 0.36%

updated 2026-10-09T16:38:57.820000

1 posts

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node auth

CVE-2026-55797
(8.8 HIGH)

EPSS: 1.55%

updated 2026-10-09T16:37:27

1 posts

### Impact Argo CD runs a shell command in the repo-server when it clones or fetches an SSH Git repository that has a proxy URL. The proxy host and port are copied into an SSH `ProxyCommand`. A host that contains shell metacharacters breaks out of that command and runs in the repo-server. All versions from v2.11.0 onward are affected, including every currently supported release. v2.10.20 and ear

CVE-2026-103412
(8.8 HIGH)

EPSS: 0.52%

updated 2026-10-09T16:33:39.007000

1 posts

Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any locat

CVE-2026-93947
(9.3 CRITICAL)

EPSS: 0.24%

updated 2026-10-09T16:17:32.090000

1 posts

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVE-2026-107375
(8.8 HIGH)

EPSS: 0.34%

updated 2026-10-09T16:17:22.297000

1 posts

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/da

CVE-2026-105436
(8.8 HIGH)

EPSS: 0.25%

updated 2026-10-09T16:17:21.427000

1 posts

Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.

CVE-2015-3306
(10.0 CRITICAL)

EPSS: 99.50%

updated 2026-10-09T16:17:18.210000

2 posts

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

Nuclei template

18 repos

https://github.com/JoseLRC97/ProFTPd-1.3.5-mod_copy-Remote-Command-Execution

https://github.com/xyk0x/cpx_proftpd

https://github.com/cd6629/CVE-2015-3306-Python-PoC

https://github.com/nootropics/propane

https://github.com/davidtavarez/CVE-2015-3306

https://github.com/cved-sources/cve-2015-3306

https://github.com/cybersensei-EH/hackviser_labs_CVE-2015-3306

https://github.com/0xm4ud/ProFTPD_CVE-2015-3306

https://github.com/diegslva/cve-2015-3306-lab

https://github.com/cdedmondson/Modified-CVE-2015-3306-Exploit

https://github.com/Z3R0space/CVE-2015-3306

https://github.com/t0kx/exploit-CVE-2015-3306

https://github.com/canpilayda/proftpd-mod_copy-cve-2015-3306

https://github.com/bcononugbor-source/OpenVAS-Vulnerability-Analysis-Incident-Response-Report

https://github.com/donmedfor/CVE-2015-3306

https://github.com/netw0rk7/CVE-2015-3306-Home-Lab

https://github.com/hackarada/cve-2015-3306

https://github.com/jptr218/proftpd_bypass

CVE-2026-79842
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-09T15:32:29

2 posts

An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713

CVE-2026-39460
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-09T15:31:42

1 posts

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

CVE-2026-108101
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-09T15:31:38

1 posts

HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated users to store files with client-supplied extensions under public/attachments/. Attackers can upload HTML or SVG files via /plants/attachments/add for stored cross-site scripting, or PHP files where .htaccess is unenforced to execute code.

CVE-2026-105281
(7.5 HIGH)

EPSS: 0.31%

updated 2026-10-09T15:31:37

1 posts

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CVE-2026-28745
(7.5 HIGH)

EPSS: 0.22%

updated 2026-10-09T15:31:35

1 posts

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

CVE-2026-39453
(8.3 HIGH)

EPSS: 0.29%

updated 2026-10-09T15:31:35

1 posts

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.

CVE-2026-33367
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-09T15:31:35

1 posts

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVE-2026-108107
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-10-09T15:31:34

1 posts

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108109
(9.1 CRITICAL)

EPSS: 0.39%

updated 2026-10-09T15:31:34

1 posts

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can guess the code without attempt limits or lockout, then read the newly set password from the HTTP response to hijack the account.

CVE-2026-83943
(8.7 HIGH)

EPSS: 0.38%

updated 2026-10-09T15:31:32

1 posts

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.

CVE-2026-86405
(9.8 CRITICAL)

EPSS: 0.20%

updated 2026-10-09T15:31:30

1 posts

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

CVE-2026-107406(CVSS UNKNOWN)

EPSS: 0.47%

updated 2026-10-09T15:31:27

9 posts

Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:   * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37

3 repos

https://github.com/ApexBreach/CVE-2026-107406-Poc

https://github.com/techupdate24/citrix-netscaler-rce-cve-2026-107406

https://github.com/ThomasPoppelgaard/netscaler-ctx697096-checker

CVE-2026-94503
(10.0 CRITICAL)

EPSS: 0.28%

updated 2026-10-09T12:31:48

1 posts

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

1 repos

https://github.com/Wayang1337/CVE-2026-94503

CVE-2026-15762
(9.8 CRITICAL)

EPSS: 0.52%

updated 2026-10-09T04:18:09.937000

1 posts

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVE-2026-14497
(8.1 HIGH)

EPSS: 0.59%

updated 2026-10-09T04:18:05.817000

1 posts

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures.

CVE-2026-69435
(9.6 CRITICAL)

EPSS: 0.39%

updated 2026-10-09T00:31:56

2 posts

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVE-2026-83947
(7.7 HIGH)

EPSS: 0.37%

updated 2026-10-09T00:31:56

1 posts

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

CVE-2026-77900
(9.8 CRITICAL)

EPSS: 0.49%

updated 2026-10-09T00:31:56

2 posts

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

CVE-2026-88131
(9.8 CRITICAL)

EPSS: 0.84%

updated 2026-10-09T00:31:56

2 posts

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

CVE-2026-84057
(8.1 HIGH)

EPSS: 0.36%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-84035
(8.1 HIGH)

EPSS: 0.37%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

CVE-2026-84875
(7.5 HIGH)

EPSS: 0.42%

updated 2026-10-09T00:31:56

1 posts

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-89091
(8.8 HIGH)

EPSS: 0.48%

updated 2026-10-09T00:31:56

1 posts

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink di

CVE-2026-107701
(8.2 HIGH)

EPSS: 0.33%

updated 2026-10-08T21:35:53.890000

1 posts

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ segments to inject properties into all objects, altering authorization flags and option defaults or crashing the process.

CVE-2026-9209
(9.8 CRITICAL)

EPSS: 0.69%

updated 2026-10-08T21:35:53.890000

1 posts

mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication enforced beyond a client-side sessionStorage flag. Attacke

1 repos

https://github.com/MS-0x404/CVE-2026-92099

CVE-2026-19482
(8.8 HIGH)

EPSS: 0.42%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.

CVE-2026-19491
(9.1 CRITICAL)

EPSS: 0.33%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

CVE-2026-19493
(7.5 HIGH)

EPSS: 0.36%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal.

CVE-2026-78401
(9.8 CRITICAL)

EPSS: 0.57%

updated 2026-10-08T21:33:42

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

CVE-2026-17189
(8.2 HIGH)

EPSS: 0.15%

updated 2026-10-08T21:33:41

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

CVE-2026-16916
(9.1 CRITICAL)

EPSS: 0.42%

updated 2026-10-08T21:33:41

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

CVE-2026-19494
(8.1 HIGH)

EPSS: 0.29%

updated 2026-10-08T21:33:41

1 posts

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

CVE-2026-84275
(7.5 HIGH)

EPSS: 0.33%

updated 2026-10-08T21:33:34

1 posts

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector.

CVE-2026-107704
(9.8 CRITICAL)

EPSS: 1.66%

updated 2026-10-08T21:33:34

1 posts

The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby pr

CVE-2026-11318
(7.8 HIGH)

EPSS: 0.19%

updated 2026-10-08T21:33:33

1 posts

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service that allows local unprivileged attackers to execute arbitrary installer packages as root by connecting to the root-owned service without authentication. Attackers can invoke the privileged installer method to run an attacker-supplied installer, achieving full root compromise of the

1 repos

https://github.com/Cr0wld3r/CVE-2026-11318

CVE-2026-107703
(9.8 CRITICAL)

EPSS: 1.85%

updated 2026-10-08T21:33:33

1 posts

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.

CVE-2026-107699
(9.8 CRITICAL)

EPSS: 1.47%

updated 2026-10-08T21:33:33

1 posts

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.

CVE-2026-107700
(9.8 CRITICAL)

EPSS: 0.50%

updated 2026-10-08T21:33:33

1 posts

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load child_process and run operating system commands in the Node.js process.

CVE-2026-107782
(7.8 HIGH)

EPSS: 0.11%

updated 2026-10-08T21:33:32

1 posts

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to reach privileged APIs by connecting from any Authenticode-signed process. Attackers can load code into a Microsoft-signed host like rundll32.exe, connect to SiSvcApiPort, and call PhSvcApiCreateService to execute code as SYSTEM.

CVE-2026-84244
(9.3 CRITICAL)

EPSS: 0.18%

updated 2026-10-08T21:33:28

1 posts

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.

CVE-2026-84276
(7.5 HIGH)

EPSS: 0.33%

updated 2026-10-08T21:33:26

1 posts

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthenticated remote attacker with network access to the edge-controller gRPC service can provide malformed task data that triggers an unchecked type assertion, causing the edge-controller process to terminate unexpectedly.

CVE-2026-95210
(9.1 CRITICAL)

EPSS: 0.23%

updated 2026-10-08T21:33:23

1 posts

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.

CVE-2026-107779
(9.8 CRITICAL)

EPSS: 0.54%

updated 2026-10-08T21:27:15.010000

1 posts

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). Unauthenticated attackers can POST GLUE_SHELL, GLUE_PYTHON, or GLUE_POWERSHELL jobs with attacker-supplied glueSource to /jobinfo/addAndStart, executing commands on the executor ho

CVE-2026-107333
(8.1 HIGH)

EPSS: 0.98%

updated 2026-10-08T21:03:43.847000

1 posts

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions and reach administrative or role gated endpoints they should not have access to. This affects all res

CVE-2026-107383
(7.5 HIGH)

EPSS: 0.39%

updated 2026-10-08T20:25:00.647000

1 posts

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring's numeric length before confirming that the ring is an array. A malformed non-array ring can therefore reserve bytes that the writing loop sk

CVE-2026-107322
(7.8 HIGH)

EPSS: 0.13%

updated 2026-10-08T20:17:31.590000

1 posts

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database command value introduced in the agent context. To remediate this issue, users should upgrade to databases-on-aws plugin version 1.7.1 or later a

CVE-2026-76463
(8.8 HIGH)

EPSS: 0.14%

updated 2026-10-08T20:08:45.857000

1 posts

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76463 are related to improper access control issues that are group

CVE-2026-107384
(8.1 HIGH)

EPSS: 0.45%

updated 2026-10-08T19:42:25

1 posts

### Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped. A key containing a backtick therefore closed the identif

CVE-2015-5477
(7.5 HIGH)

EPSS: 99.41%

updated 2026-10-08T18:32:53

2 posts

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

8 repos

https://github.com/likekabin/ShareDoc_cve-2015-5477

https://github.com/elceef/tkeypoc

https://github.com/robertdavidgraham/cve-2015-5477

https://github.com/knqyf263/cve-2015-5477

https://github.com/tintinweb/pub

https://github.com/ilanyu/cve-2015-5477

https://github.com/xycloops123/TKEY-remote-DoS-vulnerability-exploit

https://github.com/hmlio/vaas-cve-2015-5477