CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-11-03 15:40 Perth time (AWST). Critical.

1765KEV listed
205Published, last 14 days
663Critical
998High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityArista2026-10-222026-10-23
CVE-2026-111497Google Brotli Unchecked Return Value VulnerabilityGoogle2026-10-222026-10-27
CVE-2026-109619PHP Stale Internal Request-State VulnerabilityPhp2026-10-212026-10-26
CVE-2026-109618PHP Memory Corruption VulnerabilityPhp2026-10-212026-10-26
CVE-2026-9589Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfi—2026-10-20—
CVE-2026-86868An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS—2026-10-20—
CVE-2026-77936Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API ro—2026-10-20—
CVE-2026-77933DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD—2026-10-20—
CVE-2026-77932DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on—2026-10-20—
CVE-2026-77930EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating the—2026-10-20—
CVE-2026-75128Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, —2026-10-20—
CVE-2026-43845A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.—2026-10-20—
CVE-2026-43844A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.—2026-10-20—
CVE-2026-43838A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.—2026-10-20—
CVE-2026-43836A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.—2026-10-20—
CVE-2026-113620In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JW—2026-10-20—
CVE-2026-113399Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.—2026-10-20—
CVE-2026-113380In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup t—2026-10-20—
CVE-2026-109444OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without co—2026-10-20—
CVE-2026-109442piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stre—2026-10-20—
CVE-2026-105312A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag—2026-10-20—
CVE-2026-103119Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between—2026-10-20—
CVE-2026-101356Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger reques—2026-10-20—
CVE-2026-101296A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL auth—2026-10-20—
CVE-2026-102764BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityBeyondtrust2026-10-152026-10-16
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCisco2026-10-142026-10-14
CVE-2026-110447Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCollabora2026-10-142026-10-23
CVE-2026-97229GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityGitlab2026-10-132026-10-29
CVE-2026-21589Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityAtlassian2026-10-052026-10-15
CVE-2026-105134Ahsay AhsayCBS Command Injection VulnerabilityAhsay2026-10-042026-10-14
CVE-2026-104286Fortinet FortiMail Path Traversal VulnerabilityFortinet2026-10-012026-10-01
CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCisco2026-09-302026-09-30
CVE-2026-102490Zammad GmbH Zammad Improper Privilege Management VulnerabilityZammad2026-09-302026-10-02
CVE-2026-102489Zammad GmbH Zammad Session Fixation VulnerabilityZammad2026-09-302026-10-02
CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCitrix2026-09-272026-09-27
CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityCitrix2026-09-272026-09-27
CVE-2026-94127F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityF52026-09-222026-09-22
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityArista2026-09-222026-09-22
CVE-2026-93616Check Point Multiple Products Path Traversal VulnerabilityCheckpoint2026-09-222026-09-22
CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCisco2026-09-162026-09-16

1–40 of 663Next