CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-11-03 18:43 Perth time (AWST). Recent.

1765KEV listed
205Published, last 14 days
663Critical
998High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-43847A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even whe—2026-10-20—
CVE-2026-43846A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.—2026-10-20—
CVE-2026-43845A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.—2026-10-20—
CVE-2026-43844A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.—2026-10-20—
CVE-2026-43843An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.—2026-10-20—
CVE-2026-43842A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the—2026-10-20—
CVE-2026-43841A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the—2026-10-20—
CVE-2026-43840A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the—2026-10-20—
CVE-2026-43839A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.—2026-10-20—
CVE-2026-43838A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.—2026-10-20—
CVE-2026-43837A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code—2026-10-20—
CVE-2026-43836A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.—2026-10-20—
CVE-2026-43835A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potent—2026-10-20—
CVE-2026-43834A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executi—2026-10-20—
CVE-2026-34485Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the —2026-10-20—
CVE-2026-34484Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrative shell interface.—2026-10-20—
CVE-2026-28854The issue was addressed with additional app bundle integrity checks. This issue is fixed in macOS Golden Gate 27. A maliciously modified appApple2026-10-20—
CVE-2026-28853The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate pri—2026-10-20—
CVE-2026-28850An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be a—2026-10-20—
CVE-2026-18205Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. —2026-10-20—
CVE-2026-17518Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations —2026-10-20—
CVE-2026-14933Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises—2026-10-20—
CVE-2026-12489An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could al—2026-10-20—
CVE-2026-11960Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log —2026-10-20—
CVE-2026-11959Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input —2026-10-20—
CVE-2026-113620In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JW—2026-10-20—
CVE-2026-113619In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are render—2026-10-20—
CVE-2026-113583Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary—2026-10-20—
CVE-2026-113496A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured password is passed direct—2026-10-20—
CVE-2026-113495A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command-line arguments to b—2026-10-20—
CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Fi—2026-10-20—
CVE-2026-113469A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resu—2026-10-20—
CVE-2026-113468The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visit—2026-10-20—
CVE-2026-113465It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerabil—2026-10-20—
CVE-2026-113459In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can conta—2026-10-20—
CVE-2026-113442Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inje—2026-10-20—
CVE-2026-113407BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t—2026-10-20—
CVE-2026-113406BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t—2026-10-20—
CVE-2026-113405BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t—2026-10-20—
CVE-2026-113404WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic—2026-10-20—

Previous81–120 of 205Next