Total
36423 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-33284 | 1 Globaleaks | 1 Globaleaks | 2026-10-26 | N/A | 4.3 MEDIUM |
| GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue. | |||||
| CVE-2026-33815 | 1 Jackc | 1 Pgx | 2026-10-26 | N/A | 9.8 CRITICAL |
| Memory-safety vulnerability in github.com/jackc/pgx/v5. | |||||
| CVE-2026-34531 | 1 Miguelgrinberg | 1 Flask-httpauth | 2026-10-26 | N/A | 6.5 MEDIUM |
| Flask-HTTPAuth provides Basic, Digest and Token HTTP authentication for Flask routes. Prior to version 4.8.1, in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, Flask-HTTPAuth would invoke the application's token verification callback function with the token argument set to an empty string. If the application had any users in its database with an empty string set as their token, then it could potentially authenticate the client request against any of those users. This issue has been patched in version 4.8.1. | |||||
| CVE-2026-20649 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2026-10-26 | N/A | 7.5 HIGH |
| A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.8.2, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3. A user may be able to view sensitive user information. | |||||
| CVE-2026-0232 | 2 Microsoft, Paloaltonetworks | 2 Windows, Cortex Xdr Agent | 2026-10-26 | N/A | 4.4 MEDIUM |
| A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This issue may be leveraged by malware to perform malicious activity without detection. | |||||
| CVE-2026-33886 | 1 Statamic | 1 Statamic | 2026-10-26 | N/A | 6.5 MEDIUM |
| Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions 5.73.16 and 6.7.2, a control panel user with access to Antlers-enabled fields could access sensitive application configuration values by inserting config variables into their content. This has been fixed in 5.73.16 and 6.7.2. | |||||
| CVE-2026-33784 | 1 Juniper | 1 Virtual Lightweight Collector | 2026-10-26 | N/A | 9.8 CRITICAL |
| A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device. vLWC software images ship with an initial password for a high privileged account. A change of this password is not enforced during the provisioning of the software, which can make full access to the system by unauthorized actors possible.This issue affects all versions of vLWC before 3.0.94. | |||||
| CVE-2026-40910 | 1 Fatedier | 1 Frp | 2026-10-26 | N/A | 6.5 MEDIUM |
| frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHTTPUser value may access a backend protected by httpUser / httpPassword even with an incorrect Proxy-Authorization password. This issue affects deployments that explicitly use routeByHTTPUser. It does not affect ordinary HTTP proxies that do not use this feature. This vulnerability is fixed in 0.68.1. | |||||
| CVE-2026-40161 | 1 Linuxfoundation | 1 Tekton Pipelines | 2026-10-26 | N/A | 7.7 HIGH |
| Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL when the user omits the token parameter. A tenant with TaskRun or PipelineRun create permission can exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue. | |||||
| CVE-2026-2699 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-10-26 | N/A | 9.8 CRITICAL |
| Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote code execution. | |||||
| CVE-2026-34518 | 1 Aiohttp | 1 Aiohttp | 2026-10-26 | N/A | 5.3 MEDIUM |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4. | |||||
| CVE-2026-40436 | 1 Zte | 1 Zxesm Iems | 2026-10-26 | N/A | 7.1 HIGH |
| The ZTE ZXEDM iEMS product has a password reset vulnerability for any user.Because the management of the cloud EMS portal does not properly control access to the user list acquisition function, attackers can read all user list information through the user list interface. Attackers can reset the passwords of obtained user information, causing risks such as unauthorized operations. | |||||
| CVE-2026-41988 | 1 Uuidjs | 1 Uuid | 2026-10-26 | N/A | 3.2 LOW |
| uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6. In particular, UUID version 4, which is very commonly used, is unaffected by this issue. | |||||
| CVE-2026-6312 | 4 Apple, Google, Linux and 1 more | 4 Macos, Chrome, Linux Kernel and 1 more | 2026-10-26 | N/A | 3.1 LOW |
| Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-23777 | 1 Dell | 2 Data Domain Operating System, Powerprotect Data Domain | 2026-10-26 | N/A | 4.3 MEDIUM |
| Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-33813 | 1 Golang | 1 Image | 2026-10-26 | N/A | 7.5 HIGH |
| Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. | |||||
| CVE-2026-21006 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 2.4 LOW |
| Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents. | |||||
| CVE-2026-21008 | 1 Samsung | 1 Android | 2026-10-26 | N/A | 6.5 MEDIUM |
| Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information. | |||||
| CVE-2026-33816 | 1 Jackc | 1 Pgx | 2026-10-26 | N/A | 9.8 CRITICAL |
| Memory-safety vulnerability in github.com/jackc/pgx/v5. | |||||
| CVE-2026-7500 | 1 Redhat | 1 Build Of Keycloak | 2026-10-26 | N/A | 5.4 MEDIUM |
| When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write operations — because they lack the `checkAccountApiEnabled()` gate that correctly blocks four other endpoints in the same REST service class. The user needs to have permissions to use the API. | |||||