🛡️ CVE Database

Comprehensive vulnerability database aggregating CVEs from authoritative sources worldwide.

85,497
Total
27,464
Critical
18,074
High
15,384
Medium
2,652
Low

📊 All Sources Combined

CVE-2026-115934

CVE-2026-115934 | craftcms up to 4.18.8/5.11.1 Search attribute sql injection

CRITICAL
A vulnerability marked as critical has been reported in craftcms cms up to 4.18.8/5.11.1. This issue affects some unknown processing of the component Search. Performing a manipulation of the argument ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-117477

CVE-2026-117477 | GMO Prime Strategy KUSANAGI injection

CRITICAL
A vulnerability classified as critical was found in GMO Prime Strategy KUSANAGI. The impacted element is an unknown function. The manipulation results in injection. This vulnerability is known as CVE...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125359

CVE-2026-125359 | fancydirty Mediary Scout up to 2026.11.4 probePanSou server-side request forgery

CRITICAL
A vulnerability described as critical has been identified in fancydirty Mediary Scout up to 2026.11.4. Impacted is the function probePanSou. Executing a manipulation can lead to server-side request fo...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125363

CVE-2026-125363 | SecOps-7 MikroDash up to 0.8.78 Notification Channel /api/notify-channels server-side request forgery

CRITICAL
A vulnerability was found in SecOps-7 MikroDash up to 0.8.78. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/notify-channels of the compo...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125397

CVE-2026-125397 | NocoBase up to 2.2.41 ai getAccessibleAIEmployee authorization

CRITICAL
A vulnerability, which was classified as critical, was found in NocoBase up to 2.2.41. The impacted element is the function getAccessibleAIEmployee of the component ai. Such manipulation leads to auth...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125398

CVE-2026-125398 | CoreBunch Instatic up to 0.0.20 Row Authorization author handleRowAuthor id authorization

CRITICAL
A vulnerability, which was classified as critical, has been found in CoreBunch Instatic up to 0.0.20. The affected element is the function handleRowAuthor of the file /admin/api/cms/data/rows/:id/auth...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125366

CVE-2026-125366 | asciimoo Omnom up to 0.9.0 Feed Submission getFeedInfo/gofeed ParseURL/fetchImageAsInlineURL feed URLs server-side request forgery

CRITICAL
A vulnerability classified as critical has been found in asciimoo Omnom up to 0.9.0. This issue affects the function getFeedInfo/gofeed ParseURL/fetchImageAsInlineURL of the component Feed Submission....
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125367

CVE-2026-125367 | Picosh Pico up to 4.1.2 Feeds Service Fetcher.ParseURL server-side request forgery

CRITICAL
A vulnerability described as critical has been identified in Picosh Pico up to 4.1.2. This vulnerability affects the function Fetcher.ParseURL of the component Feeds Service. Executing a manipulation ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125386

CVE-2026-125386 | moyangzhan langchain4j-aideepin up to 3.32.0 Message Reference CharacterMessageController message uuid resource injection

CRITICAL
A vulnerability labeled as problematic has been found in moyangzhan langchain4j-aideepin up to 3.32.0. Affected by this issue is the function CharacterMessageController of the component Message Refere...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125387

CVE-2026-125387 | faveosuite Faveo Helpdesk up to 2.0.3 TicketController authorization

CRITICAL
A vulnerability categorized as critical has been discovered in faveosuite Faveo Helpdesk up to 2.0.3. Affected is an unknown function of the component TicketController. The manipulation results in aut...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125381

CVE-2026-125381 | gcpaas DataRoom up to 3.0.0 MyBatisService MyBatisService.generateSql inputParam sql injection

CRITICAL
A vulnerability was found in gcpaas DataRoom up to 3.0.0. It has been rated as critical. This impacts the function MyBatisService.generateSql of the component MyBatisService. The manipulation of the a...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125406

CVE-2026-125406 | Ettercap up to 0.8.4.1 Telnet Dissector ec_telnet.c stack-based overflow (EUVD-2026-120569)

CRITICAL
A vulnerability was found in Ettercap up to 0.8.4.1 and classified as very critical. The affected element is an unknown function of the file src/dissectors/ec_telnet.c of the component Telnet Dissecto...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125375

CVE-2026-125375 | zmister2016 MrDoc up to 1.1.1 Document Sorting project_doc_sort/manage_project_doc_sort sort_data improper authorization

CRITICAL
A vulnerability has been found in zmister2016 MrDoc up to 1.1.1 and classified as critical. Impacted is the function project_doc_sort/manage_project_doc_sort of the component Document Sorting. This ma...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125400

CVE-2026-125400 | Ettercap up to 0.8.4.1 src/ec_filter.c func_pcre use after free

CRITICAL
A vulnerability classified as very critical was found in Ettercap up to 0.8.4.1. This affects the function func_pcre of the file src/ec_filter.c. Executing a manipulation can lead to use after free. ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125369

CVE-2026-125369 | fsinfuhh Bitpoll up to 0.11.0 Views views.py resource injection

CRITICAL
A vulnerability described as problematic has been identified in fsinfuhh Bitpoll up to 0.11.0. Affected by this vulnerability is an unknown functionality of the file views.py of the component Views. S...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125405

CVE-2026-125405 | Ettercap up to 0.8.4.1 HTTP Dissector src/dissectors/ec_http.c Parse_NTLM_Auth out-of-bounds (EUVD-2026-120568)

CRITICAL
A vulnerability marked as critical has been reported in Ettercap up to 0.8.4.1. Affected is the function Parse_NTLM_Auth of the file src/dissectors/ec_http.c of the component HTTP Dissector. This mani...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125402

CVE-2026-125402 | Ettercap up to 0.8.4.1 SSL SNI src/ec_sslwrap.c sslw_get_clienthello_sni out-of-bounds (EUVD-2026-120565)

CRITICAL
A vulnerability labeled as critical has been found in Ettercap up to 0.8.4.1. This impacts the function sslw_get_clienthello_sni of the file src/ec_sslwrap.c of the component SSL SNI Handler. The mani...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125404

CVE-2026-125404 | Ettercap up to 0.8.4.1 src/ec_encryption_ccmp.c ccmp_decrypt integer underflow (EUVD-2026-120567)

CRITICAL
A vulnerability identified as very critical has been detected in Ettercap up to 0.8.4.1. This affects the function ccmp_decrypt of the file src/ec_encryption_ccmp.c. The manipulation leads to integer ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125371

CVE-2026-125371 | Tinyproxy up to 1.11.3 src/acl.c acl_string_processing access control

CRITICAL
A vulnerability categorized as critical has been discovered in Tinyproxy up to 1.11.3. The impacted element is the function acl_string_processing of the file src/acl.c. Executing a manipulation can le...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125394

CVE-2026-125394 | FreeRDP up to 3.32.9 GDI Update use after free

CRITICAL
A vulnerability was found in FreeRDP up to 3.32.9. It has been rated as critical. The affected element is the function update_gdi_patblt/update_gdi_polygon_cb/update_gdi_mem3blt of the component GDI U...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE

CISA KEV P100

Visit Source
CVE-2026-123158

CVE-2026-123158 - OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability

CRITICAL
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass. Remediation due: 2026-11-12
⚠️ Exploit Available OpenBSD CISA KEV
Affected OpenSSH
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-116779

CVE-2026-116779 - SignalWire FreeSwitch Code Injection Vulnerability

CRITICAL
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution. Remediation due: 2026-11-12
⚠️ Exploit Available SignalWire CISA KEV
Affected FreeSwitch
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-123218

CVE-2026-123218 - IBM Aspera Faspex Incorrect Authorization Vulnerability

CRITICAL
IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. Remediati...
⚠️ Exploit Available IBM CISA KEV
Affected Aspera Faspex
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-102895

CVE-2026-102895 - GPUStack Improper Authentication Vulnerability

CRITICAL
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclos...
⚠️ Exploit Available GPUStack CISA KEV
Affected GPUStack
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-19868

CVE-2026-19868 - SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

CRITICAL
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication ...
⚠️ Exploit Available SonicWall CISA KEV
Affected SonicOS SSLVPN
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference MITRE
CVE-2024-27834

CVE-2024-27834 - Apple Multiple Products Improper Authentication Vulnerability

CRITICAL
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authen...
⚠️ Exploit Available Apple CISA KEV
Affected Multiple Products
Type CVE
6 days ago (November 4, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-119977

CVE-2026-119977 - WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

CRITICAL
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. ...
⚠️ Exploit Available WordPress CISA KEV
Affected WordPress Core
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-118527

CVE-2026-118527 - Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

CRITICAL
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known ...
⚠️ Exploit Available Ivanti CISA KEV
Affected Connect Secure
Type CVE
1 week ago (October 30, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-111357

CVE-2026-111357 - Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CRITICAL
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chai...
⚠️ Exploit Available Ivanti CISA KEV
Affected Connect Secure
Type CVE
1 week ago (October 30, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-97229

CVE-2026-97229 - GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

CRITICAL
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a spe...
⚠️ Exploit Available GitLab CISA KEV
Affected Community Edition and Enterpri ...
Type CVE
1 week ago (October 29, 2026 at 12:00 AM)
Reference MITRE

CIRCL CVE P95

Visit Source
CVE-2026-97631

CVE-2026-97631 - edk2: Pre-boot RCE in EDK II PXE driver

CRITICAL
A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code...
⚠️ Exploit Available AppStream CIRCL CVE
CVSS Score 8.8/10
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-119373

CVE-2026-119373 - sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5

HIGH
A flaw was found in SQLite. A heap-based buffer overflow exists in the Full-Text Search 5 (FTS5) extension during the merging of prefix document lists. An attacker capable of inserting negative row id...
AppStream CIRCL CVE
CVSS Score 7.8/10
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-119374

CVE-2026-119374 - sqlite: sqlite: Arbitrary code execution via corrupted FTS5 index

HIGH
A flaw was found in SQLite. When the Full Text Search (FTS5) extension is enabled and secure-delete mode is active, processing a database containing a corrupted search index triggers a heap-based buff...
⚠️ Exploit Available AppStream CIRCL CVE
CVSS Score 7.8/10
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-119379

CVE-2026-119379 - sqlite: sqlite: Arbitrary code execution via crafted session changesets

HIGH
A flaw was found in SQLite's session extension. A local attacker can supply a specially crafted changeset containing inconsistent table definitions, causing the application to write data past allocate...
AppStream CIRCL CVE
CVSS Score 7.8/10
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-17614

CVE-2026-17614 - wildfly-core: Path Traversal on WildFly Domain Controller

HIGH
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validat...
CIRCL CVE
CVSS Score 4.4/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-15560

CVE-2026-15560 - openjdk-orb: unauthed class loading via IIOP in EAP

HIGH
when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate a...
CIRCL CVE
CVSS Score 8.1/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-19610

CVE-2026-19610 - wildfly-platform-mbean: wildfly-platform-mbean: RBAC sensitive attribute read bypass for platform RuntimeMxBean

HIGH
A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The issue occurs because the handler for the read-resource oper...
CIRCL CVE
CVSS Score 6.5/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-85634

CVE-2026-85634 - wildfly-core: wildfly-core: Deployer RBAC role privilege escalation via path traversal in deployment name

HIGH
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the l...
CIRCL CVE
CVSS Score 8.8/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-15564

CVE-2026-15564 - wildfly-ejb: wildfly-iiop-openjdk: EAP IIOP listeners may permit unauthed deserialization

HIGH
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious obj...
CIRCL CVE
CVSS Score 7.4/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE
CVE-2026-13506

CVE-2026-13506 - bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing

HIGH
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit a vulnerability related to how the software processes lazy ASN.1 sequences, which can reset an internal nesting-depth guard....
⚠️ Exploit Available CIRCL CVE
CVSS Score 7.5/10
Type CVE
4 days ago (November 6, 2026 at 12:00 AM)
Reference Reference MITRE

NVD NIST P90

Visit Source
CVE-2026-120518

CVE-2026-120518

CRITICAL
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation...
NVD NIST
CVSS Score 9.1/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-120534

CVE-2026-120534

CRITICAL
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insuff...
NVD NIST
CVSS Score 9.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-92610

CVE-2026-92610

CRITICAL
In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:...
NVD NIST
CVSS Score 9.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-4052

CVE-2026-4052

CRITICAL
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System...
NVD NIST
CVSS Score 9.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-13594

CVE-2026-13594

CRITICAL
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
NVD NIST
CVSS Score 9.1/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-120558

CVE-2026-120558

HIGH
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trac...
NVD NIST
CVSS Score 7.2/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-120833

CVE-2026-120833

HIGH
labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the...
NVD NIST
CVSS Score 7.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-76955

CVE-2026-76955

HIGH
A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.
NVD NIST
CVSS Score 8.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-120574

CVE-2026-120574

HIGH
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeContro...
NVD NIST
CVSS Score 8.1/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-107441

CVE-2026-107441

HIGH
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potential...
⚠️ Exploit Available NVD NIST
CVSS Score 8.8/10
Type CVE
1 week ago (November 3, 2026 at 12:00 AM)
Reference MITRE

GitHub Advisories P80

Visit Source
CVE-2026-88986

CVE-2026-88986 - Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses

MEDIUM
## Summary The Kubeflow Pipelines frontend reflected untrusted pod names and namespaces into HTML error responses from the pod-information and pod-events routes. An attacker could craft a link that c...
go GitHub Advisories
CVSS Score 6.1/10
Affected github.com/kubeflow/pipelines
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-77433

CVE-2026-77433 - Kiwi TCMS account confirmation open redirect through protocol-relative URLs

MEDIUM
## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith("...
pip GitHub Advisories
CVSS Score 6.1/10
Affected kiwitcms
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-88985

CVE-2026-88985 - Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

MEDIUM
## Summary Kubeflow Pipelines API server does not sufficiently validate SQL identifier fields decoded from the `page_token` pagination parameter. Client-controlled fields can reach SQL query construc...
go GitHub Advisories
CVSS Score 6.5/10
Affected github.com/kubeflow/pipelines
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-63471

CVE-2026-63471 - fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

CRITICAL
### Summary fastapi-code-generator (koxudaxi) emits the OpenAPI path into the generated main.py route decorator as a single-quoted string literal (`@app.get('/u/<path>/x')`) without escaping the `'`....
pip GitHub Advisories
Affected fastapi-code-generator
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-77596

CVE-2026-77596 - Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

CRITICAL
## Summary In multi-user mode, the Kubeflow Pipelines API server's HTTP multipart upload endpoints (`POST /apis/v2beta1/pipelines/upload` and `POST /apis/v2beta1/pipelines/upload_version`) perform no...
go GitHub Advisories
CVSS Score 9.6/10
Affected github.com/kubeflow/pipelines
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-102895

CVE-2026-102895 - GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

CRITICAL
### Impact In GPUStack before v2.2.0, `get_current_user` (in `gpustack/api/auth.py`) promotes any request whose source is considered loopback to the built-in administrator account when `force_auth_lo...
pip GitHub Advisories
CVSS Score 9.8/10
Affected gpustack
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-115770

CVE-2026-115770 - Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

CRITICAL
## Summary An authenticated Pocket ID user can request an email-verification token while their account uses an address they control, change the account email address, and then redeem the previously i...
go GitHub Advisories
CVSS Score 9.6/10
Affected github.com/pocket-id/pocket-id ...
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-63470

CVE-2026-63470 - fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

CRITICAL
### Summary fastapi-code-generator (koxudaxi) emits an operation's `summary` as the generated route handler's docstring, using a triple-quoted string without escaping `"""`. A `"""` in the summary cl...
pip GitHub Advisories
Affected fastapi-code-generator
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-63469

CVE-2026-63469 - fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

CRITICAL
### Summary fastapi-code-generator (koxudaxi) emits an operation's extra responses into the route decorator's responses={...} dict, using each response's status-code key as a single-quoted string lit...
pip GitHub Advisories
Affected fastapi-code-generator
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-63197

CVE-2026-63197 - traQ: XSS in the User Uploaded File Retrieval API

HIGH
### Impact For instances where `TRAQ_STORAGE_TYPE` is set to `local`, the file retrieval API `/files/{fileId}` could serve user-uploaded SVG or HTML files in a way that allowed them to be rendered di...
go GitHub Advisories
CVSS Score 7.3/10
Affected github.com/traPtitech/traQ
Type CVE
1 day ago (November 9, 2026 at 12:00 AM)
Reference MITRE

OSV Database P75

Visit Source
DEBIAN-CVE-2008-2544

DEBIAN-CVE-2008-2544 - linux [Debian:12]

UNKNOWN
Debian:12 OSV Database
Affected linux
Type CVE
2 weeks ago (October 23, 2026 at 12:00 AM)
Reference
DEBIAN-CVE-2008-4609

DEBIAN-CVE-2008-4609 - linux [Debian:12]

UNKNOWN
Debian:12 OSV Database
Affected linux
Type CVE
2 weeks ago (October 23, 2026 at 12:00 AM)
Reference
DEBIAN-CVE-2005-3660

DEBIAN-CVE-2005-3660 - linux [Debian:12]

UNKNOWN
Debian:12 OSV Database
Affected linux
Type CVE
2 weeks ago (October 23, 2026 at 12:00 AM)
Reference
GHSA-2464-fhr4-w9xw

GHSA-2464-fhr4-w9xw - next [npm]

UNKNOWN
npm OSV Database
Affected next
Type CVE
2 weeks ago (October 22, 2026 at 12:00 AM)
Reference
GHSA-24rc-8hj2-v98c

GHSA-24rc-8hj2-v98c - pillow [PyPI]

UNKNOWN
PyPI OSV Database
Affected pillow
Type CVE
2 weeks ago (October 22, 2026 at 12:00 AM)
Reference
GHSA-27h8-gf7j-v5hc

GHSA-27h8-gf7j-v5hc - pillow [PyPI]

UNKNOWN
PyPI OSV Database
Affected pillow
Type CVE
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
DEBIAN-CVE-2007-3719

DEBIAN-CVE-2007-3719 - linux [Debian:12]

UNKNOWN
Debian:12 OSV Database
Affected linux
Type CVE
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
GHSA-254f-3936-288h

GHSA-254f-3936-288h - pillow [PyPI]

UNKNOWN
PyPI OSV Database
Affected pillow
Type CVE
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
GHSA-22hg-r758-rrw9

GHSA-22hg-r758-rrw9 - pillow [PyPI]

UNKNOWN
PyPI OSV Database
Affected pillow
Type CVE
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
GHSA-332p-7hrc-92wf

GHSA-332p-7hrc-92wf - pillow [PyPI]

UNKNOWN
PyPI OSV Database
Affected pillow
Type CVE
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference

VulDB P60

Visit Source
CVE-2026-115934

CVE-2026-115934 | craftcms up to 4.18.8/5.11.1 Search attribute sql injection

CRITICAL
A vulnerability marked as critical has been reported in craftcms cms up to 4.18.8/5.11.1. This issue affects some unknown processing of the component Search. Performing a manipulation of the argument ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-117477

CVE-2026-117477 | GMO Prime Strategy KUSANAGI injection

CRITICAL
A vulnerability classified as critical was found in GMO Prime Strategy KUSANAGI. The impacted element is an unknown function. The manipulation results in injection. This vulnerability is known as CVE...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-104619

CVE-2026-104619 | PackageKit up to 1.4.0 Zypp Backend privileges management

CRITICAL
A vulnerability was found in PackageKit up to 1.4.0. It has been declared as very critical. Impacted is an unknown function of the component Zypp Backend. The manipulation results in improper privileg...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125359

CVE-2026-125359 | fancydirty Mediary Scout up to 2026.11.4 probePanSou server-side request forgery

CRITICAL
A vulnerability described as critical has been identified in fancydirty Mediary Scout up to 2026.11.4. Impacted is the function probePanSou. Executing a manipulation can lead to server-side request fo...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125397

CVE-2026-125397 | NocoBase up to 2.2.41 ai getAccessibleAIEmployee authorization

CRITICAL
A vulnerability, which was classified as critical, was found in NocoBase up to 2.2.41. The impacted element is the function getAccessibleAIEmployee of the component ai. Such manipulation leads to auth...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125367

CVE-2026-125367 | Picosh Pico up to 4.1.2 Feeds Service Fetcher.ParseURL server-side request forgery

CRITICAL
A vulnerability described as critical has been identified in Picosh Pico up to 4.1.2. This vulnerability affects the function Fetcher.ParseURL of the component Feeds Service. Executing a manipulation ...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125386

CVE-2026-125386 | moyangzhan langchain4j-aideepin up to 3.32.0 Message Reference CharacterMessageController message uuid resource injection

CRITICAL
A vulnerability labeled as problematic has been found in moyangzhan langchain4j-aideepin up to 3.32.0. Affected by this issue is the function CharacterMessageController of the component Message Refere...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125363

CVE-2026-125363 | SecOps-7 MikroDash up to 0.8.78 Notification Channel /api/notify-channels server-side request forgery

CRITICAL
A vulnerability was found in SecOps-7 MikroDash up to 0.8.78. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/notify-channels of the compo...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125387

CVE-2026-125387 | faveosuite Faveo Helpdesk up to 2.0.3 TicketController authorization

CRITICAL
A vulnerability categorized as critical has been discovered in faveosuite Faveo Helpdesk up to 2.0.3. Affected is an unknown function of the component TicketController. The manipulation results in aut...
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE
CVE-2026-125366

CVE-2026-125366 | asciimoo Omnom up to 0.9.0 Feed Submission getFeedInfo/gofeed ParseURL/fetchImageAsInlineURL feed URLs server-side request forgery

CRITICAL
A vulnerability classified as critical has been found in asciimoo Omnom up to 0.9.0. This issue affects the function getFeedInfo/gofeed ParseURL/fetchImageAsInlineURL of the component Feed Submission....
⚠️ Exploit Available VulDB
Type CVE
10 hours ago (November 10, 2026 at 12:00 AM)
Reference MITRE