Total
417778 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57207 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1. | |||||
| CVE-2026-54865 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | |||||
| CVE-2026-54864 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | |||||
| CVE-2026-54860 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |||||
| CVE-2026-54857 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |||||
| CVE-2026-54856 | 2026-10-30 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |||||
| CVE-2026-54852 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | |||||
| CVE-2026-42701 | 2026-10-30 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | |||||
| CVE-2026-42694 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | |||||
| CVE-2026-42691 | 2026-10-30 | N/A | 5.4 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. | |||||
| CVE-2026-27394 | 2026-10-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | |||||
| CVE-2026-27063 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | |||||
| CVE-2026-27062 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5. | |||||
| CVE-2026-21811 | 2026-10-30 | N/A | 3.8 LOW | ||
| HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface. | |||||
| CVE-2026-18477 | 2 Gnu, Redhat | 3 Tar, Enterprise Linux, Openshift Container Platform | 2026-10-30 | N/A | 4.4 MEDIUM |
| A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows—including extracting into a newly created directory without using the -P option do not mitigate the issue. | |||||
| CVE-2026-120046 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually. | |||||
| CVE-2026-119979 | 2026-10-30 | N/A | 8.8 HIGH | ||
| LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch. | |||||
| CVE-2026-119727 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. Successful exploitation requires an attacker to provide a malformed H.265 media file to a vulnerable application, and is limited to a denial-of-service impact. | |||||
| CVE-2026-119721 | 2026-10-30 | N/A | 6.1 MEDIUM | ||
| Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure. | |||||
| CVE-2026-119288 | 2026-10-30 | N/A | 7.0 HIGH | ||
| Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat shims by prepending cmd /c, causing cmd.exe to reparse a command line assembled with C-runtime quoting rules. A build running on Windows that resolves a tool from node_modules/.bin and passes attacker-influenced text containing an unquoted &, |, or ^ metacharacter can execute an additional attacker-chosen command in the build's context with access to its credentials. POSIX platforms are not affected. This issue is fixed in version 1.51.0. | |||||