WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-20✕
Overview 13,867 matches · 494 in Waratek scope · 82 protected · 216 exploited · 83 CISA KEV · 1,019 public PoC · 223 EPSS ≥ 0.5
13,867matches 494in Waratek scope3.6% 82protected0.6% 216exploited1.6% 83CISA KEV0.6% 1,019public PoC7.3% 223EPSS ≥ 0.51.6%
Protected by Waratek 83 0.6% Rule in development 0 0.0% Mitigation candidate 23 0.2% No exploit published 388 2.8% Outside Waratek scope 269 1.9% Not applicable 13,099 94.5% Withdrawn CVE 5 0.0%
Critical 1,372 9.9% High 6,150 44.3% Medium 5,829 42.0% Low 507 3.7% None 4 0.0% Unknown 5 0.0%
blocked by ARMR today 82 0.6% partly blocked 1 0.0% not blocked 13,784 99.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 216 1.6% Working exploit published 858 6.2% Proof of concept only 781 5.6% Forecast only 50 0.4% No public exploit 11,962 86.3%
split by peak 2,134 / year
Withdrawn CVE: 5Not applicable: 13,099Outside Waratek scope: 269No exploit published: 388Mitigation candidate: 23Protected by Waratek: 83 Unknown: 5None: 4Low: 507Medium: 5,829High: 6,150Critical: 1,372 not blocked: 13,784partly blocked: 1blocked by ARMR today: 82 No public exploit: 11,962Forecast only: 50Proof of concept only: 781Working exploit published: 858Exploited: 216
19971 Not applicable1 Medium1 not blocked1 No public exploit1 19980 19998 Not applicable8 High5 Medium3 not blocked8 Working exploit published3 No public exploit5 20003 Not applicable3 High3 not blocked3 Working exploit published2 No public exploit1 20015 Not applicable5 High2 Medium3 not blocked5 Working exploit published2 No public exploit3 200227 Not applicable27 High15 Medium12 not blocked27 Working exploit published6 No public exploit21 200326 Not applicable26 High8 Medium16 Low2 not blocked26 Working exploit published11 No public exploit15 200417 Not applicable17 High5 Medium12 not blocked17 Working exploit published7 No public exploit10 200530 Not applicable30 High13 Medium12 Low5 not blocked30 Exploited2 Working exploit published7 No public exploit21 200656 Protected by Waratek2 No exploit published1 Not applicable53 High19 Medium31 Low6 blocked by ARMR today2 not blocked54 Exploited2 Working exploit published17 No public exploit37 2007242 Mitigation candidate1 No exploit published3 Outside Waratek scope3 Not applicable231 Withdrawn CVE4 High98 Medium122 Low18 Unknown4 not blocked242 Exploited2 Working exploit published71 Proof of concept only1 No public exploit168 2008379 No exploit published1 Outside Waratek scope7 Not applicable370 Withdrawn CVE1 High200 Medium165 Low13 Unknown1 not blocked379 Exploited2 Working exploit published134 No public exploit243 2009301 Mitigation candidate1 No exploit published4 Outside Waratek scope3 Not applicable293 High118 Medium176 Low7 not blocked301 Exploited6 Working exploit published123 Forecast only1 No public exploit171 2010285 Protected by Waratek1 Mitigation candidate1 No exploit published10 Not applicable273 Critical4 High118 Medium152 Low11 blocked by ARMR today1 not blocked284 Exploited6 Working exploit published58 Forecast only3 No public exploit218 2011356 Mitigation candidate1 No exploit published9 Outside Waratek scope1 Not applicable345 Critical1 High160 Medium176 Low19 not blocked356 Exploited2 Working exploit published40 Proof of concept only2 Forecast only3 No public exploit309 2012354 Protected by Waratek1 Mitigation candidate1 No exploit published12 Outside Waratek scope2 Not applicable338 Critical1 High96 Medium242 Low15 blocked by ARMR today1 not blocked353 Exploited5 Working exploit published39 No public exploit310 2013495 Protected by Waratek2 Mitigation candidate1 No exploit published9 Outside Waratek scope28 Not applicable455 Critical1 High136 Medium329 Low29 blocked by ARMR today2 not blocked493 Exploited8 Working exploit published43 Proof of concept only1 Forecast only2 No public exploit441 2014543 Protected by Waratek6 Mitigation candidate1 No exploit published10 Outside Waratek scope19 Not applicable507 High145 Medium365 Low33 blocked by ARMR today6 not blocked537 Exploited4 Working exploit published28 Proof of concept only1 Forecast only2 No public exploit508 2015385 Protected by Waratek3 No exploit published7 Outside Waratek scope11 Not applicable364 High147 Medium219 Low19 blocked by ARMR today3 not blocked382 Exploited2 Working exploit published34 Proof of concept only1 Forecast only4 No public exploit344 2016530 Protected by Waratek8 Mitigation candidate3 No exploit published12 Outside Waratek scope9 Not applicable498 Critical59 High253 Medium210 Low8 blocked by ARMR today8 not blocked522 Exploited11 Working exploit published46 Proof of concept only3 Forecast only6 No public exploit464 2017962 Protected by Waratek6 No exploit published25 Outside Waratek scope23 Not applicable908 Critical118 High434 Medium400 Low10 blocked by ARMR today6 not blocked956 Exploited16 Working exploit published58 Proof of concept only1 Forecast only6 No public exploit881 20181,286 Protected by Waratek6 Mitigation candidate3 No exploit published24 Outside Waratek scope42 Not applicable1,211 Critical173 High730 Medium370 Low13 blocked by ARMR today6 not blocked1,280 Exploited35 Working exploit published41 Proof of concept only11 Forecast only2 No public exploit1,197 2019939 Protected by Waratek3 No exploit published15 Outside Waratek scope28 Not applicable893 Critical119 High435 Medium360 Low25 blocked by ARMR today2 partly blocked1 not blocked936 Exploited13 Working exploit published23 Proof of concept only7 Forecast only2 No public exploit894 2020839 Protected by Waratek5 Mitigation candidate4 No exploit published17 Outside Waratek scope41 Not applicable772 Critical138 High386 Medium298 Low17 blocked by ARMR today5 not blocked834 Exploited11 Working exploit published14 Proof of concept only4 Forecast only6 No public exploit804 2021689 Protected by Waratek10 No exploit published14 Outside Waratek scope27 Not applicable638 Critical86 High345 Medium242 Low16 blocked by ARMR today10 not blocked679 Exploited14 Working exploit published2 Proof of concept only5 Forecast only1 No public exploit667 2022756 Protected by Waratek7 No exploit published20 Outside Waratek scope9 Not applicable720 Critical89 High401 Medium257 Low9 blocked by ARMR today7 not blocked749 Exploited11 Working exploit published4 Proof of concept only130 Forecast only2 No public exploit609 2023823 Protected by Waratek3 Mitigation candidate1 No exploit published24 Outside Waratek scope7 Not applicable788 Critical116 High388 Medium308 Low11 blocked by ARMR today3 not blocked820 Exploited14 Working exploit published4 Proof of concept only70 Forecast only8 No public exploit727 2024710 Protected by Waratek5 Mitigation candidate2 No exploit published26 Outside Waratek scope4 Not applicable673 Critical92 High337 Medium258 Low23 blocked by ARMR today5 not blocked705 Exploited17 Working exploit published8 Proof of concept only79 Forecast only2 No public exploit604 2025686 Protected by Waratek5 No exploit published20 Not applicable661 Critical86 High291 Medium258 Low51 blocked by ARMR today5 not blocked681 Exploited20 Working exploit published23 Proof of concept only141 No public exploit502 20262,134 Protected by Waratek10 Mitigation candidate3 No exploit published125 Outside Waratek scope5 Not applicable1,991 Critical289 High862 Medium832 Low147 None4 blocked by ARMR today10 not blocked2,124 Exploited13 Working exploit published10 Proof of concept only324 No public exploit1,787
1999200220052008201120142017202020232026
13,867 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 139 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-116654 Medium 2026-11-03 Not applicable No public exploit Tanium addressed an improper input validation vulnerability in Threat Response.
CVE-2026-116653 Medium 2026-11-03 Not applicable No public exploit Tanium addressed an improper input validation vulnerability in Threat Response.
CVE-2026-86365 Medium 2026-11-02 Not applicable No public exploit Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of Service.
CVE-2026-59047 Medium 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59046 Medium 2026-11-02 Not applicable No public exploit In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59021 Medium 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-59008 Medium 2026-11-02 Not applicable No public exploit In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58985 Medium 2026-11-02 Not applicable No public exploit In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58964 High 2026-11-02 Not applicable No public exploit In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58963 High 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58955 Medium 2026-11-02 Not applicable No public exploit In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58938 High 2026-11-02 Not applicable No public exploit In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58937 Medium 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58875 Medium 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58838 Medium 2026-11-02 Not applicable No public exploit In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-58817 Medium 2026-11-02 Not applicable No public exploit In parseKnownActivityEmbeddingCerts of ParsingUtils.java, there is a possible permanent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55272 Medium 2026-11-02 Not applicable No public exploit In loadDescription of DeviceAdminAdd.java, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55262 High 2026-11-02 Not applicable No public exploit In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-49934 High 2026-11-02 Not applicable No public exploit In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-28665 High 2026-11-02 Not applicable No public exploit In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28643 Medium 2026-11-02 Not applicable No public exploit In multiple locations, there is a possible denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-28597 High 2026-11-02 Not applicable No public exploit In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120320 Low 2026-11-02 Not applicable Proof of concept only A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.
CVE-2026-116768 High 2026-11-02 Not applicable No public exploit CVE-2026-116768 is a missing length validation vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service when connecting for the first time.
CVE-2026-116767 High 2026-11-02 Not applicable No public exploit CVE-2026-116767 is an improper input handling vulnerability in Secure Access servers prior to 14.61. Authenticated attackers can cause a persistent denial of service.
CVE-2026-116766 High 2026-11-02 Not applicable No public exploit CVE-2026-116766 is an improper input handling vulnerability in the Secure Access server versions between 13.0 and prior to 14.61. Attackers can cause a persistent denial of service of the server.
CVE-2026-111959 Critical 2026-11-02 Not applicable No public exploit Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
CVE-2026-106804 High 2026-11-02 Not applicable Proof of concept only A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.
CVE-2026-120236 Low 2026-11-01 Not applicable Proof of concept only A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.
CVE-2026-91917 High 2026-10-30 Not applicable No public exploit Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.
CVE-2026-76029 High 2026-10-30 Not applicable No public exploit Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: High)
CVE-2026-63339 High 2026-10-30 Not applicable No public exploit IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.
CVE-2026-62958 High 2026-10-30 Not applicable Proof of concept only libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.
CVE-2026-62337 Medium 2026-10-30 Not applicable No public exploit SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. `EcPointLoader::multi_scalar_multiplication` places a `Value::Assigned(_)` base paired with `Value::Constant(ONE)` into its unscaled variable-base list and passes it directly to `sum_with_const`. The default shim delegates to halo2-lib `EccChip::sum`, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as `(0, 0)` can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.
CVE-2026-62335 Medium 2026-10-30 Not applicable No public exploit OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `bytes32` values without checking that either is less than the `BN254` scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
CVE-2026-62333 High 2026-10-30 Not applicable No public exploit OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `MemoryMerkleAir` does not forbid Merkle expansion rows at `parent_height` = 0 or below while `expand_direction` != 0. A malicious prover can fabricate a subtree below a memory leaf and swap digests inside that subtree to change the committed memory root without a corresponding memory operation. The fraudulent rows still balance against the Merkle and compression buses and require no memory-bus operation for the changed leaf. Because the memory Merkle root binds VM memory state across continuation segment boundaries, this affects the soundness of OpenVM proofs using persistent memory. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.
CVE-2026-61618 Medium 2026-10-30 Not applicable No public exploit SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. `PlonkProof::read` selects scalars using `accumulator_indices` and passes them to `AccumulatorEncoding::from_repr`. For the EVM loader, `LimbsEncoding::from_repr` forwards them to `EvmLoader::ec_point_from_limbs` in `snark-verifier/src/loader/evm/loader.rs`, where `shl` and `add` reconstruct coordinates before `validate_ec_point` checks the resulting affine point rather than the original limb bounds. The related native path in `snark-verifier/src/pcs/kzg/accumulator.rs` can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.
CVE-2026-59978 High 2026-10-30 Not applicable Proof of concept only AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.
CVE-2026-119342 Medium 2026-10-30 Not applicable Proof of concept only Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.
CVE-2026-119339 Medium 2026-10-30 Not applicable No public exploit Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4.
CVE-2026-118565 High 2026-10-30 Not applicable No public exploit Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*.
CVE-2026-90869 High 2026-10-29 Not applicable No public exploit A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
CVE-2026-21157 High 2026-10-29 Not applicable No public exploit Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.
CVE-2026-119280 Low 2026-10-29 No exploit published No public exploit MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_length and bqual_length columns returned by XA RECOVER. The methods allocated and split Xid byte arrays without validating the lengths against Xid.MAXGTRIDSIZE, Xid.MAXBQUALSIZE, or the actual data payload. A malicious or compromised server, or a machine-in-the-middle attacker, could cause large allocations, NegativeArraySizeException, or ArrayIndexOutOfBoundsException during XA recovery. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVE-2026-119210 Medium 2026-10-29 No exploit published No public exploit MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName() check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string literals, or comments instead of requiring a real statement. A malicious or compromised server, or a machine-in-the-middle attacker, could return crafted database or table identifiers that the connector reused in metadata or updatable-result queries, then answer with a LOCAL INFILE request for a client file. With allowLocalInfile enabled, this caused the connector to stream any readable client-host file named by the crafted text, including through DatabaseMetaData.getImportedKeys(), DatabaseMetaData.getExportedKeys(), or ResultSet.updateRow() paths. This issue is fixed in versions 3.3.7, 3.4.5, and 3.5.11.
CVE-2026-119130 Low 2026-10-29 Not applicable No public exploit Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can supply an absolute URL that a forward proxy or gateway at that authority honors, reaching hosts disallowed by embedder filtering policies.
CVE-2026-118776 Medium 2026-10-29 Not applicable Proof of concept only Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node-forge validated only the final byte of PKCS#7 padding during CBC and ECB decryption and accepted zero, oversized, or mismatched padding bytes. Malformed ciphertext could consequently be accepted and up to four plaintext blocks could be silently removed, causing an integrity failure in applications that treated successful decryption as proof of valid padding. This issue is fixed in version 1.4.1.
CVE-2026-88967 High 2026-10-28 Not applicable No public exploit A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
CVE-2026-88858 Medium 2026-10-28 Not applicable No public exploit A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.
CVE-2026-86983 Medium 2026-10-28 Not applicable No public exploit A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
CVE-2026-54455 High 2026-10-28 Not applicable No public exploit OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, activity DataGrid date filtering in `home:CallsDataGrid` and `activity:ActivityDataGrid` uses request-controlled `period`, `startDate` and `endDate` parameters without sufficient validation or escaping. The vulnerable code is in `modules/home/dataGrids.php` and `modules/activity/dataGrids.php`. The `startDate` and `endDate` values are inserted into SQL string comparisons without safe escaping, and `period` can directly influence generated SQL. An authenticated user with access to the affected DataGrid endpoints can alter the intended query to access sensitive database contents, including user account data, candidate records, contact details, company information, job orders and activity history. A valid OpenCATS login is required; unauthenticated exploitation is not established. This issue is fixed in version 0.10.0.
CVE-2026-21830 Low 2026-10-28 Not applicable No public exploit HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.
CVE-2026-118537 Medium 2026-10-28 Not applicable No public exploit A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in improper input validation. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
CVE-2026-111551 High 2026-10-28 Protected by Waratek No public exploit Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large size and force a multi-gigabyte allocation. The affected paths are, in Kafka Streams, ProcessorRecordContext (header count), ChangedDeserializer (varint value length), CombinedKeySchema (foreign-key length, which could also produce a negative size), ProcessorMetadata (key length), and AssignmentInfo group-assignment decoding; and, in the clients library, ListDeserializer (used by ListSerde). Impact: An attacker can trigger the oversized allocation and raise an OutOfMemoryError that crashes the affected consumer or Kafka Streams thread; the broker and the rest of the cluster are unaffected. The reachable surface depends on the path: writing a crafted record to a Streams application's internal changelog or repartition topics, or committing crafted offset metadata to its consumer group (Streams internal paths); writing a crafted record to any topic that a consumer reads with ListSerde (ListDeserializer); or, as a member of a Streams consumer group, returning crafted assignment data when elected leader (AssignmentInfo). Because a crafted record remains in its topic, the error can recur on restart. The record size limit (max.message.bytes) does not help, because the allocation is driven by a size field rather than by the input's length. Mitigation: Upgrade to Apache Kafka 4.2.2, 4.3.2, or 4.4.0. Where authorization is enabled, restrict write access to each application's internal topics and consumer group to its own principal, and restrict who can produce to topics that are consumed with ListSerde. Resolution: From Apache Kafka 4.2.2, 4.3.2, and 4.4.0: these deserialization paths validate the declared size against the remaining input before allocating and reject input that fails the check.
CVE-2026-93434 High 2026-10-27 Not applicable No public exploit An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request.
CVE-2026-118179 High 2026-10-27 Not applicable No public exploit Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
CVE-2026-118173 Medium 2026-10-27 Not applicable No public exploit MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy (for example, TLP), the guard only verified that at least one tag of that taxonomy matched the configured allowed list. It did not verify that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check. This allowed data marked with a higher classification or sensitivity level to be distributed through feeds configured to only distribute lower-classification data, effectively bypassing the intended data-handling restrictions. The vulnerability affected both event-level and attribute-level tag validation, including attributes nested within objects and shadow attributes. An attacker with the ability to author or modify MISP events in a feed source could include non-allowed taxonomy tags alongside allowed ones to exfiltrate more sensitive data to feed consumers than the guard policy intended to permit.
CVE-2026-118025 High 2026-10-27 Not applicable No public exploit Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-86985 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved input validation. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-116671 Low 2026-10-26 Not applicable No public exploit Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
CVE-2026-116469 High 2026-10-26 Not applicable No public exploit MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks. The functions check_required_taxonomy_exists, check_required_taxonomy_tags_allowed, check_blocked_attribute_categories, and check_blocked_analyst_data_sharing_groups_uuids performed case-sensitive string comparisons when matching event tags, attribute categories, and sharing-group UUIDs against configured allow/block lists. An attacker with the ability to create or modify events in a MISP instance (or a connected instance that pushes events through the guard) could craft events using different letter case in taxonomy tag names, attribute categories, or sharing-group UUIDs to bypass the configured security policies. For example, if the policy requires the 'tlp' taxonomy with only 'tlp:clear' allowed, an event tagged 'TLP:AMBER' would not be recognized as belonging to the 'tlp' taxonomy and would therefore not be checked against the allowed-tags list, resulting in the event being forwarded to feed consumers. Similarly, a blocked attribute category such as 'Person' would not match a configured block entry of 'person', allowing the attribute to pass through the filter. The security impact is unauthorized disclosure of threat-intelligence data that the operator intended to restrict. Events carrying non-allowed TLP (Traffic Light Protocol) markings, blocked attribute categories, or blocked sharing-group associations are forwarded to downstream feed consumers in violation of the configured distribution policy. This undermines the confidentiality controls that MISP Guard is designed to enforce. The vulnerability is trivially exploitable: the attacker only needs to alter the letter case of a tag, category, or UUID string. No authentication beyond normal MISP event-creation privileges is required, and no user interaction is needed.
CVE-2026-116372 High 2026-10-26 Not applicable No public exploit MISP mispguard is a security filtering proxy that inspects and blocks MISP feed responses based on configured rules. The process_feed_response method in src/mispguard.py was responsible for evaluating feed responses before they reached the MISP instance. The original logic only explicitly handled the case where the HTTP status code was not 200 by passing the response through without filtering, on the assumption that non-200 responses would not carry ingestible event data. However, HTTP 2xx status codes other than 200 (such as 201 Created, 203 Non-Authoritative Information, and 206 Partial Content) were also passed through unfiltered. Because MISP may still ingest content from these responses, a malicious or compromised feed host could return a 203 or 206 status code with arbitrary content, effectively bypassing all of mispguard's filtering rules. This allowed unfiltered or malicious feed data to be ingested into the MISP instance, undermining the security controls that mispguard is designed to enforce. The vulnerability requires the attacker to control or compromise a feed endpoint configured in the MISP instance. No authentication or user interaction is required beyond the feed polling mechanism already in place.
CVE-2026-116230 Low 2026-10-26 Not applicable No public exploit A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component.
CVE-2026-116098 Medium 2026-10-26 Not applicable No public exploit A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible. The patch is named EA39 Security Patch. Applying a patch is the recommended action to fix this issue.
CVE-2026-115915 Critical 2026-10-26 Not applicable No public exploit vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Image-capable request paths through parse_image() and fetch_image() can therefore dispatch an EPS payload to host components. A host with Ghostscript affected by CVE-2024-29510 can execute commands with the vLLM process's privileges, while environments using Pillow 12.0.0 through 12.2.0 can trigger CVE-2026-59203 and exhaust media-loading workers. Deployments without the applicable vulnerable dependency are not affected by that corresponding impact. This issue is fixed in version 0.32.0.
CVE-2026-115905 Critical 2026-10-26 Not applicable Proof of concept only zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
CVE-2026-113913 Medium 2026-10-26 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing web content may disclose sensitive information.
CVE-2026-113899 Medium 2026-10-26 Not applicable No public exploit The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.
CVE-2026-112682 High 2026-10-26 Not applicable No public exploit An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, visionOS 27.2, watchOS 27.2. A remote attacker may be able to cause unexpected app termination.
CVE-2026-112658 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112620 High 2026-10-26 Not applicable No public exploit A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2, visionOS 27.2. An attacker in a privileged network position may be able to cause a denial-of-service.
CVE-2026-112555 High 2026-10-26 Not applicable No public exploit A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.
CVE-2026-112430 High 2026-10-26 Not applicable No public exploit An authentication issue was addressed with improved validation of user attributes. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.
CVE-2026-111974 Medium 2026-10-26 Not applicable No public exploit The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount.
CVE-2026-116178 High 2026-10-25 Not applicable No public exploit vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inference/v1/generate endpoint. Attackers can replay a valid multimodal item with repeated or overlapping mm_placeholders ranges or mismatched kwargs_data and mm_hashes lists, producing a negative text span in Qwen2.5-VL position construction that terminates the engine.
CVE-2026-116174 High 2026-10-25 Not applicable No public exploit vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs to EngineCore. Attackers can submit requests with out-of-vocabulary prompt.token_ids values to trigger a fatal embedding lookup failure that terminates EngineCore and leaves the server unhealthy.
CVE-2026-116173 High 2026-10-25 Not applicable No public exploit vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attackers can send Generate or GenerateStream requests with output_logprobs enabled and more than 128 output_candidates.token_ids, triggering a fatal sampler exception that crashes the engine.
CVE-2026-116172 High 2026-10-25 Not applicable No public exploit vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via CandidateTokens.top_n. Attackers can send Generate or GenerateStream requests with oversized or integer-wrapping top_n values to trigger torch.topk failures that terminate EngineCore.
CVE-2026-116164 Medium 2026-10-25 Not applicable No public exploit Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.
CVE-2026-89317 Medium 2026-10-23 Not applicable Proof of concept only gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 requires a recipient to reject a JWS whose listed critical extension parameters it does not understand. gose implements no header extensions, so every token carrying a non-empty `crit` should have been rejected — and none were.
CVE-2026-86020 Medium 2026-10-23 Not applicable No public exploit Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts can import a CSV file containing formula-prefixed values, such as =1+1, into user-controlled part fields. When the affected part is later exported as an XLSX spreadsheet, Part-DB writes the attacker-controlled value using PhpSpreadsheet's setCellValue() method without neutralising spreadsheet formula characters. As a result, the exported XLSX file contains an executable spreadsheet formula cell rather than a plain text value. If another user exports and opens the spreadsheet, the formula may be evaluated by their spreadsheet software. This issue has been patched in version 2.13.2.
CVE-2026-57210 High 2026-10-23 Not applicable No public exploit Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
CVE-2026-57209 High 2026-10-23 Not applicable Proof of concept only Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
CVE-2026-55444 Medium 2026-10-23 Not applicable No public exploit The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RSS servlet (RssResolver, GET /rss/) accepts the q and filterQuery parameters and concatenates them into Solr queries without validation. The servlet predates the REST API layer and lacks the input validation present in GET /api/v1/records/rss. q forms the main query body (wrapped only in literal parentheses); filterQuery is passed directly as a Solr fq. An unauthenticated attacker can inject Solr boolean operators to break out of the wrapping and render the trailing access-condition filter-query suffix optional, so that access-restricted records are included in the generated RSS feed. The q and filterQuery parameters are the same underlying vulnerability in the same servlet; q (the main query body) has the broader scope. This issue has been patched in version 26.05.
CVE-2026-55442 Medium 2026-10-23 Not applicable No public exploit The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version 26.05, SolrTools.cleanUpQuery() strips Solr local-parameter syntax ({!...}) from user-supplied query strings before they reach Solr. Its regex can be bypassed by wrapping the local parameter in a second pair of curly braces ({{!...}}): the outer braces are stripped, the inner {!...} survives intact, and a valid Solr local parameter is forwarded. The flaw is in the shared sanitizer, so it affects any endpoint that routes user input through cleanUpQuery. The double-brace bypass applies from v23.10 (the greedy \{(.+)\} regex); a related bare-!join rewrap path is present. This issue has been patched in version 26.05.
CVE-2026-115883 Medium 2026-10-23 Not applicable No public exploit LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with ".".join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples. This issue is fixed in langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2.
CVE-2026-115547 Critical 2026-10-23 Not applicable No public exploit An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.
CVE-2026-115479 Medium 2026-10-23 Not applicable No public exploit baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, an unauthenticated visitor can supply a comma-separated address list in a public mail form's email field and cause a single auto-reply to be addressed to multiple third parties. MailMessageMailer::sendFormToUser() passes the visitor-controlled userMail value to parseAndNormalizeMailAddresses(), which splits it with explode(',') and supplies every resulting address to setTo(). Newly created forms with an email-type field are affected when the separate, optional VALID_EMAIL server-side validation is not enabled; browser type=email validation does not prevent crafted requests. The bundled contact form enables VALID_EMAIL and is not affected. The auto-reply uses the site's sender identity and includes partially attacker-controlled content, allowing abuse of the site to deliver unsolicited mail. This issue has been patched in versions 5.3.2 and 5.4.2.
CVE-2026-115384 Critical 2026-10-22 Not applicable No public exploit Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
CVE-2026-115249 Low 2026-10-22 Not applicable Proof of concept only A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Impacted is an unknown function of the file patappointtime.php of the component Appointment Booking. This manipulation of the argument day/time/appdate causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-76505 High 2026-10-21 Not applicable No public exploit A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Software that affects Cisco ASR 9000 and 9900 Series Aggregation Services Routers as well as Cisco ASR 9902 and 9903 Compact High-Performance Routers could allow an unauthenticated, remote attacker to cause network processor (NP) errors, resulting in a line card reset or shutdown and a denial of service (DoS) condition.&nbsp; This vulnerability is due to the incorrect handling of crafted IPv4 packets that are received on an affected line card interface and processed as for-us traffic. The issue can result in an NP reset, causing traffic loss on the affected line card while it recovers. Under repeated reset conditions, the network processor may enter a persistent shutdown state, in which case an explicit line card reload may be required to restore traffic. The vulnerability is within the IPv4 packet-processing path. Transit IPv4 traffic does not trigger this issue and IPv6 traffic cannot trigger it.
CVE-2026-76476 High 2026-10-21 Not applicable No public exploit As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.
CVE-2026-76462 Medium 2026-10-21 Not applicable No public exploit A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a series of crafted IPC messages to a local socket. A successful exploit could allow the attacker to perform limited file write operations on the filesystem with SYSTEM or root privileges. Although this vulnerability affects the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux operating systems, this vulnerability could be used to obtain full root privileges on macOS and Linux. For that reason Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates.
CVE-2026-114101 Medium 2026-10-21 Not applicable Proof of concept only Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose charset is not utf-8 or us-ascii. Unauthenticated attackers can send a decoy filename with filename*=iso-8859-1''shell.php, or filename* alone, so FILES-based rules never see the real name, letting dangerous uploads reach backends that honor filename*.
CVE-2026-114100 Medium 2026-10-21 Not applicable No public exploit Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type value exactly, so URL-encoded bodies whose Content-Type carries a media-type parameter are never parsed. Unauthenticated attackers can send application/x-www-form-urlencoded; charset=UTF-8 to keep ARGS_POST and REQUEST_BODY empty, evading body rules while the backend still processes the payload.
CVE-2026-114099 Medium 2026-10-21 Not applicable Proof of concept only Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.
CVE-2026-113786 Low 2026-10-21 Not applicable No public exploit pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PDF containing image data labeled with the /DCTDecode filter that causes Pillow to select and invoke an unintended image parser when the image is loaded. Environments without the optional Pillow dependency are not affected. This issue is fixed in version 6.21.1.
CVE-2026-110938 High 2026-10-21 No exploit published No public exploit In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol message and reply handling. An unauthenticated remote attacker or malicious JITServer can transmit malformed network payloads that cause out-of-bounds heap reads, immediately crashing the JITServer daemon or client JVM process via a segmentation fault (SIGSEGV).
CVE-2024-6423 Medium 2026-10-21 Not applicable No public exploit The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
CVE-2020-37289 Medium 2026-10-21 Not applicable No public exploit Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.
‹ prev page 2 of 139 next ›