Total
826 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-16404 | 1 Mozilla | 1 Firefox Mobile | 2026-10-24 | N/A | 7.4 HIGH |
| Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | |||||
| CVE-2026-16076 | 2026-10-24 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function OpenApiRoute.chat_send of the file astrbot/dashboard/routes/open_api.py of the component API. Such manipulation of the argument Username leads to authentication bypass by spoofing. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-62224 | 2026-10-24 | N/A | 5.4 MEDIUM | ||
| OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names. Attackers with lower-trust access can perform actions requiring stronger authorization by exploiting the mutable display name binding in the affected feature. | |||||
| CVE-2026-3183 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass. | |||||
| CVE-2026-50755 | 2026-10-24 | N/A | 9.8 CRITICAL | ||
| An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value | |||||
| CVE-2026-65570 | 2026-10-24 | N/A | 8.1 HIGH | ||
| Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | |||||
| CVE-2026-64665 | 2026-10-24 | N/A | 8.1 HIGH | ||
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0. | |||||
| CVE-2026-59916 | 1 Dell | 1 Display And Peripheral Manager | 2026-10-24 | N/A | 7.8 HIGH |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | |||||
| CVE-2026-53791 | 1 Samba | 1 Rsync | 2026-10-24 | N/A | 9.1 CRITICAL |
| rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address. | |||||
| CVE-2026-6181 | 2026-10-24 | N/A | 5.9 MEDIUM | ||
| The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account. | |||||
| CVE-2026-59914 | 1 Dell | 1 Display And Peripheral Manager | 2026-10-24 | N/A | 7.8 HIGH |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | |||||
| CVE-2026-6387 | 2026-10-24 | N/A | 7.0 HIGH | ||
| A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges. | |||||
| CVE-2026-32469 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions. | |||||
| CVE-2026-61217 | 1 Oracle | 1 Security Service | 2026-10-24 | N/A | 6.4 MEDIUM |
| Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle SSL API). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N). | |||||
| CVE-2026-54478 | 1 Nlnetlabs | 1 Unbound | 2026-10-24 | N/A | 3.7 LOW |
| In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place. | |||||
| CVE-2026-64875 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass. | |||||
| CVE-2026-63683 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules. | |||||
| CVE-2026-28900 | 1 Apple | 1 Macos | 2026-10-24 | N/A | 5.5 MEDIUM |
| A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks. | |||||
| CVE-2023-25743 | 1 Mozilla | 1 Firefox Focus | 2026-10-24 | N/A | 7.5 HIGH |
| A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome.<br>*This bug only affects Firefox Focus. Other versions of Firefox are unaffected.*. This vulnerability affects Firefox < 110 and Firefox ESR < 102.8. | |||||
| CVE-2026-11922 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks. | |||||