Total
41 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-105008 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-27 | N/A | 9.0 CRITICAL |
| No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-40217 | 1 Litellm | 1 Litellm | 2026-10-26 | N/A | 8.8 HIGH |
| LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI. | |||||
| CVE-2026-40435 | 1 F5 | 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 18 more | 2026-10-26 | N/A | 5.3 MEDIUM |
| When configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-77639 | 1 Torproject | 1 Tor | 2026-10-18 | N/A | 5.3 MEDIUM |
| Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022. | |||||
| CVE-2025-13315 | 3 Linux, Lynxtechnology, Microsoft | 3 Linux Kernel, Twonky Server, Windows | 2026-10-18 | N/A | 9.8 CRITICAL |
| Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. An unauthenticated attacker can bypass web service API authentication controls to leak a log file and read the administrator's username and encrypted password. | |||||
| CVE-2025-66432 | 2026-10-18 | N/A | 5.0 MEDIUM | ||
| In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date. | |||||
| CVE-2025-53967 | 2026-10-08 | N/A | 8.0 HIGH | ||
| Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a crafted HTTP POST request with shell metacharacters in input that is used by a fetchWithRetry curl command. The vulnerable endpoint fails to properly sanitize user-supplied input, enabling the attacker to inject malicious commands that are executed with the privileges of the MCP process. Exploitation requires network access to the MCP interface. | |||||
| CVE-2025-62820 | 2026-10-08 | N/A | 4.9 MEDIUM | ||
| Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network. | |||||
| CVE-2025-56558 | 2026-10-08 | N/A | 3.0 LOW | ||
| The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information. | |||||
| CVE-2026-102134 | 1 Accellion | 1 Kiteworks | 2026-10-07 | N/A | 5.4 MEDIUM |
| Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and revoked sessions, were not applied. | |||||
| CVE-2026-61909 | 1 Cyrus | 1 Imap | 2026-09-16 | N/A | 3.5 LOW |
| An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT. | |||||
| CVE-2026-35388 | 1 Openbsd | 1 Openssh | 2026-07-24 | N/A | 2.5 LOW |
| OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. | |||||
| CVE-2026-43505 | 1 Prosody | 1 Prosody | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur. | |||||
| CVE-2026-25916 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. | |||||
| CVE-2025-8557 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks. | |||||
| CVE-2025-67303 | 1 Comfy | 1 Comfyui-manager | 2026-06-17 | N/A | 7.5 HIGH |
| An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface | |||||
| CVE-2025-62001 | 1 Bullwall | 1 Ransomware Containment | 2026-06-17 | N/A | 8.8 HIGH |
| BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable settings. | |||||
| CVE-2025-59033 | 2026-06-17 | N/A | 7.4 HIGH | ||
| The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate's TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) may not be blocked, whether hypervisor-protected code integrity (HVCI) is enabled or not. NOTE: The vendor disputes this CVE ID assignment and states that the driver blocklist is intended for use with HVCI. | |||||
| CVE-2025-54351 | 1 Es | 1 Iperf3 | 2026-06-17 | N/A | 8.9 HIGH |
| In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). | |||||
| CVE-2025-54309 | 1 Crushftp | 1 Crushftp | 2026-06-17 | N/A | 9.0 CRITICAL |
| CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025. | |||||