Total
729 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-19490 | 1 Citrix | 2 Netscaler Application Delivery Controller, Netscaler Gateway | 2026-10-26 | N/A | 9.8 CRITICAL |
| Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21. | |||||
| CVE-2026-8697 | 1 Tp-link | 2 Archer C64, Archer C64 Firmware | 2026-10-26 | N/A | 8.8 HIGH |
| Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, the SSH service allows unlimited authentication attempts and uses the same credentials as the web interface. This enables an attacker to brute-force valid credentials via SSH. Successful exploitation could allow an attacker with adjacent network access to obtain administrative credentials through unrestricted authentication attempts and subsequently gain full administrative access to the device, impacting system confidentiality, integrity, and availability. | |||||
| CVE-2026-54817 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4. | |||||
| CVE-2026-42735 | 2026-10-26 | N/A | 8.2 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0. | |||||
| CVE-2026-42745 | 2026-10-26 | N/A | 7.3 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Authentication Bypass.This issue affects Smart Online Order for Clover: from n/a through <= 1.6.0. | |||||
| CVE-2026-49767 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |||||
| CVE-2026-42749 | 2026-10-26 | N/A | 7.1 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments for Any Post Types (Remove comments) comments-plus allows Password Recovery Exploitation.This issue affects Disable Comments for Any Post Types (Remove comments): from n/a through <= 1.3.0. | |||||
| CVE-2026-35087 | 2026-10-26 | N/A | N/A | ||
| Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter login credentials by executing the appropriate command. This issue was fixed in versions below: - NCP: version 1.24.0250 - IPx series: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading. | |||||
| CVE-2026-8990 | 2026-10-26 | N/A | N/A | ||
| A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification. This issue was fixed in version 4.4.3 | |||||
| CVE-2026-42760 | 2026-10-26 | N/A | 7.5 HIGH | ||
| Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Password Recovery Exploitation.This issue affects Backup and Staging by WP Time Capsule: from n/a through <= 1.22.25. | |||||
| CVE-2026-35090 | 2026-10-26 | N/A | N/A | ||
| In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can connect to the modem via a telephone with a specific caller ID. This allows them to bypass admin authentication and gain full access to the service protocol and configuration panel. This vulnerability is independent of the telephone exchanges configuration. If remote access is disabled, calling with this caller ID will temporarily enable it. This issue was fixed in versions below: - IPL-256: version 6.61.0040 - IPM-032: version 6.61.0040 - CCT-1668: version 6.56.0430 - MAC-6400: version 6.56.0430 - CXS-0424: version 6.30.0510 The issue STILL EXISTS in End-Of-Life telephone exchanges in versions 4.xx and below: - CCT-1668 (CCT1CPU) - MAC-6400 - CXS-0424 These products were discontinued in 2011 and 2012 and and will not receive updates. These products require a hardware update in order to receive a software update. The vendor recommends that users of these devices contact the their service department directly to determine the options for upgrading. | |||||
| CVE-2026-49071 | 2026-10-26 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. | |||||
| CVE-2026-54804 | 2026-10-26 | N/A | 7.6 HIGH | ||
| Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | |||||
| CVE-2026-6768 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-26 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | |||||
| CVE-2026-6760 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-26 | N/A | 9.8 CRITICAL |
| Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150. | |||||
| CVE-2026-40799 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions. | |||||
| CVE-2026-55666 | 2026-10-25 | N/A | N/A | ||
| Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try block checks for an email parameter. If the JWT does not contain an email address, the application falls back to accepting an arbitrary email value supplied directly in the request. Attackers are able to forge Apple JWTs that do not contain an email address and leverage this vulnerability to carry out account takeover attacks. This vulnerability is fixed in 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13. | |||||
| CVE-2026-49764 | 2026-10-25 | N/A | 9.8 CRITICAL | ||
| Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. | |||||
| CVE-2026-39450 | 2026-10-25 | N/A | 7.1 HIGH | ||
| Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. | |||||
| CVE-2026-48970 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. | |||||