CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-11-03 18:43 Perth time (AWST). Recent.

1765KEV listed
205Published, last 14 days
663Critical
998High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-113403ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted c—2026-10-20—
CVE-2026-113402ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path —2026-10-20—
CVE-2026-113401Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.—2026-10-20—
CVE-2026-113400Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.—2026-10-20—
CVE-2026-113399Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.—2026-10-20—
CVE-2026-113392A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunct—2026-10-20—
CVE-2026-113391A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfu—2026-10-20—
CVE-2026-113390A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/main—2026-10-20—
CVE-2026-113389A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the fil—2026-10-20—
CVE-2026-113388A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/adminis—2026-10-20—
CVE-2026-113386Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit t—2026-10-20—
CVE-2026-113385A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the fi—2026-10-20—
CVE-2026-113384A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipul—2026-10-20—
CVE-2026-113383A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Per—2026-10-20—
CVE-2026-113382A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of th—2026-10-20—
CVE-2026-113381A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-inc—2026-10-20—
CVE-2026-113380In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup t—2026-10-20—
CVE-2026-113378A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the com—2026-10-20—
CVE-2026-113358LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to dow—2026-10-20—
CVE-2026-113357@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports —2026-10-20—
CVE-2026-113356DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unseri—2026-10-20—
CVE-2026-113355Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by craft—2026-10-20—
CVE-2026-113354Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files t—2026-10-20—
CVE-2026-113353LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_edi—2026-10-20—
CVE-2026-113352uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file—2026-10-20—
CVE-2026-113351libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offse—2026-10-20—
CVE-2026-113350react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript—2026-10-20—
CVE-2026-113349OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authentic—2026-10-20—
CVE-2026-112787OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view —2026-10-20—
CVE-2026-112786OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated —2026-10-20—
CVE-2026-112785OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate s—2026-10-20—
CVE-2026-112784OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to se—2026-10-20—
CVE-2026-112783OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-—2026-10-20—
CVE-2026-112373A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist—2026-10-20—
CVE-2026-112240The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not ver—2026-10-20—
CVE-2026-112239The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks—2026-10-20—
CVE-2026-112238The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters o—2026-10-20—
CVE-2026-112237The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does n—2026-10-20—
CVE-2026-112177A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase —2026-10-20—
CVE-2026-112148A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an —2026-10-20—

Previous121–160 of 205Next