Total
7599 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-19209 | 2026-10-23 | 4.0 MEDIUM | 3.5 LOW | ||
| A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. | |||||
| CVE-2026-19378 | 2026-10-23 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/task_id/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-53942 | 2026-10-23 | N/A | 9.9 CRITICAL | ||
| Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request vulnerability appears to remain present in conda/conda. The affected workflow is .github/workflows/update.yml. It is triggered by issue_comment events containing @conda-bot render or @conda-bot recreate. For the render path, the workflow obtains the pull request head repository and branch from the PR API, checks out that PR-controlled repository/ref using secrets.SYNC_TOKEN, and then runs conda/actions/template-files@7f6830b1428a9bd47f0b068892c77eae95207037. The external template-files action reads its default configuration and templates from the checked-out working directory. In the confirmed finding, that action uses an unsandboxed Jinja2 environment to render attacker-controlled template content. This creates a Pwn Request chain in which an untrusted PR/comment path can reach template rendering in a privileged token context. This issue has been patched via commit 9c0f238. | |||||
| CVE-2026-44758 | 2026-10-23 | N/A | 9.1 CRITICAL | ||
| SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application. | |||||
| CVE-2026-13094 | 1 Ibm | 1 I Access Client Solutions | 2026-10-23 | N/A | 7.8 HIGH |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file. | |||||
| CVE-2026-0298 | 1 Paloaltonetworks | 1 Globalprotect | 2026-10-23 | N/A | 8.1 HIGH |
| An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client. The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected. | |||||
| CVE-2026-27544 | 2026-10-23 | N/A | 10.0 CRITICAL | ||
| Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |||||
| CVE-2026-115547 | 2026-10-23 | N/A | 9.1 CRITICAL | ||
| An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account. | |||||
| CVE-2026-50772 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function. | |||||
| CVE-2026-59894 | 2026-10-23 | N/A | N/A | ||
| sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0. | |||||
| CVE-2026-94267 | 2026-10-23 | N/A | 9.0 CRITICAL | ||
| The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not perform any capability check when updating a post through one of its front-end form actions, allowing unauthenticated visitors to overwrite arbitrary posts, including the ones in which the site stores its own field definitions, which in turn leads to arbitrary code execution on the server. Exploitation requires the site to publish a form whose post-update action maps both its target and its content to visitor-submitted values. | |||||
| CVE-2019-15598 | 2 Microsoft, Tree-kill Project | 2 Windows, Tree-kill | 2026-10-23 | 7.5 HIGH | 9.8 CRITICAL |
| A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | |||||
| CVE-2026-112949 | 2026-10-23 | N/A | 4.7 MEDIUM | ||
| Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3. | |||||
| CVE-2026-76494 | 2026-10-22 | N/A | 7.8 HIGH | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94. | |||||
| CVE-2026-67919 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components | |||||
| CVE-2026-67960 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components | |||||
| CVE-2026-75077 | 2026-10-22 | 5.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-67961 | 2026-10-22 | N/A | 7.8 HIGH | ||
| An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. | |||||
| CVE-2026-32444 | 2026-10-22 | N/A | 9.9 CRITICAL | ||
| Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. | |||||
| CVE-2026-38165 | 2026-10-22 | N/A | 9.8 CRITICAL | ||
| A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a crafted expression. | |||||