Every new High and Critical CVE, with CVSS, CISA KEV status and whether public exploit code exists. https://threatroundup.com/cve/ https://threatroundup.com/cve/cve-2026-92092/ 2026-10-29T20:17:36+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-92092 7.4 false false

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could…

https://threatroundup.com/cve/cve-2026-9536/ 2026-10-29T19:17:30+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-9536 7.5 false false

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-9535/ 2026-10-29T19:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-9535 8.2 false false

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-8824/ 2026-10-29T19:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-8824 7.5 false false

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-8822/ 2026-10-29T19:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-8822 7.5 false false

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk (version(s): 9.6.1). A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-42057/ 2026-10-29T19:17:21+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-42057 7.5 false false

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-41216/ 2026-10-29T19:17:21+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-41216 7.5 false false

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-96203/ 2026-10-29T16:20:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96203 8.8 false false

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-96199/ 2026-10-29T16:20:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96199 8.8 false false

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-96198/ 2026-10-29T16:20:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96198 8.8 false false

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-96196/ 2026-10-29T16:20:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96196 8.8 false false

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

https://threatroundup.com/cve/cve-2026-96192/ 2026-10-29T16:20:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96192 8.8 false false

Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-96187/ 2026-10-29T16:20:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96187 7.4 false false

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

https://threatroundup.com/cve/cve-2026-93680/ 2026-10-29T16:20:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-93680 9.8 false true

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

https://threatroundup.com/cve/cve-2026-88077/ 2026-10-29T16:19:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-88077 8.8 false false

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-85899/ 2026-10-29T16:19:45+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-85899 8.1 false false

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-85897/ 2026-10-29T16:19:45+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-85897 8.8 false false

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-85890/ 2026-10-29T16:19:45+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-85890 8.8 false false

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-119145/ 2026-10-29T16:18:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-119145 9.4 false false

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to…

https://threatroundup.com/cve/cve-2026-119144/ 2026-10-29T16:18:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119144 8.7 false false

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions that the server evaluates…

https://threatroundup.com/cve/cve-2026-119129/ 2026-10-29T16:18:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119129 8.6 false false

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link…

https://threatroundup.com/cve/cve-2026-119128/ 2026-10-29T16:18:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-119128 9.1 false false

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID…

https://threatroundup.com/cve/cve-2026-119127/ 2026-10-29T16:18:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119127 8.6 false false

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers. Attackers knowing a victim's login name…

https://threatroundup.com/cve/cve-2026-119120/ 2026-10-29T16:18:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119120 7.7 false false

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace model the server loads. Attackers can reference a malicious repository with a pickle weight file…

https://threatroundup.com/cve/cve-2026-119119/ 2026-10-29T16:18:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119119 8.7 false false

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields of untrusted CrawlerRunConfig bodies. Unauthenticated attackers can send huge values to /crawl or /crawl/stream to…

https://threatroundup.com/cve/cve-2026-114148/ 2026-10-29T16:17:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114148 7.8 false true

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

https://threatroundup.com/cve/cve-2026-110309/ 2026-10-29T16:17:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110309 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

https://threatroundup.com/cve/cve-2026-110245/ 2026-10-29T16:17:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110245 7.5 false false

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.

https://threatroundup.com/cve/cve-2026-110244/ 2026-10-29T16:17:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110244 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

https://threatroundup.com/cve/cve-2026-110196/ 2026-10-29T16:17:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110196 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs.

https://threatroundup.com/cve/cve-2026-110193/ 2026-10-29T16:17:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110193 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the…

https://threatroundup.com/cve/cve-2026-110186/ 2026-10-29T16:17:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-110186 9.8 false false

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

https://threatroundup.com/cve/cve-2026-107329/ 2026-10-29T16:17:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-107329 9.9 false true

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

https://threatroundup.com/cve/cve-2026-107328/ 2026-10-29T16:17:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-107328 9.9 false true

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

https://threatroundup.com/cve/cve-2026-107327/ 2026-10-29T16:17:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-107327 9.9 false true

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

https://threatroundup.com/cve/cve-2026-107326/ 2026-10-29T16:17:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-107326 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

https://threatroundup.com/cve/cve-2026-104339/ 2026-10-29T16:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-104339 9.8 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

https://threatroundup.com/cve/cve-2026-104328/ 2026-10-29T16:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-104328 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

https://threatroundup.com/cve/cve-2026-104324/ 2026-10-29T16:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-104324 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

https://threatroundup.com/cve/cve-2026-104317/ 2026-10-29T16:17:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-104317 8.1 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

https://threatroundup.com/cve/cve-2026-103092/ 2026-10-29T16:17:41+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103092 8.5 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

https://threatroundup.com/cve/cve-2026-101288/ 2026-10-29T16:17:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-101288 8.8 false false

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

https://threatroundup.com/cve/cve-2026-119052/ 2026-10-29T14:17:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119052 8.7 false false

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with…

https://threatroundup.com/cve/cve-2026-119050/ 2026-10-29T14:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-119050 9.2 false false

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for…

https://threatroundup.com/cve/cve-2026-119049/ 2026-10-29T14:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119049 7.2 false false

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes,…

https://threatroundup.com/cve/cve-2019-25781/ 2026-10-29T14:17:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2019-25781 8.7 false false

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadratic…

https://threatroundup.com/cve/cve-2026-49142/ 2026-10-29T13:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-49142 8.7 false false

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint.…

https://threatroundup.com/cve/cve-2026-96767/ 2026-10-29T12:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96767 7.2 false false

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all versions up to, and including, 9.3.2 due to insufficient input sanitization and output escaping. This makes it…

https://threatroundup.com/cve/cve-2026-119028/ 2026-10-29T12:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119028 8.7 false false

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the…

https://threatroundup.com/cve/cve-2026-119027/ 2026-10-29T12:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119027 7.7 false false

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init()…

https://threatroundup.com/cve/cve-2026-119025/ 2026-10-29T12:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-119025 7.7 false false

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint values from malicious MCP…

https://threatroundup.com/cve/cve-2026-115821/ 2026-10-29T12:17:11+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115821 7.2 false false

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…

https://threatroundup.com/cve/cve-2026-110184/ 2026-10-29T12:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110184 7.5 false false

The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…

https://threatroundup.com/cve/cve-2026-15564/ 2026-10-29T06:17:20+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-15564 7.4 false false

Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows…

https://threatroundup.com/cve/cve-2026-114488/ 2026-10-29T06:17:19+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114488 7.4 false false

A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port…

https://threatroundup.com/cve/cve-2026-42922/ 2026-10-29T04:18:36+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-42922 9.8 false false

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

https://threatroundup.com/cve/cve-2026-118579/ 2026-10-28T23:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118579 8.9 false false

A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be…

https://threatroundup.com/cve/cve-2026-118804/ 2026-10-28T22:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118804 7.5 false false

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly…

https://threatroundup.com/cve/cve-2026-118803/ 2026-10-28T22:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118803 7.5 false false

Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-parsed as a Bricks dynamic data tag. Attackers…

https://threatroundup.com/cve/cve-2026-118755/ 2026-10-28T22:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118755 8.6 false false

Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters…

https://threatroundup.com/cve/cve-2026-118753/ 2026-10-28T22:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118753 8.5 false false

FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past the canvas allocation via unclipped GIF frame rectangles. Attackers can craft a GIF whose frame left plus width exceeds the logical…

https://threatroundup.com/cve/cve-2026-118752/ 2026-10-28T22:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118752 8.5 false false

FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write…

https://threatroundup.com/cve/cve-2026-118694/ 2026-10-28T22:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118694 8.7 false false

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for…

https://threatroundup.com/cve/cve-2026-118692/ 2026-10-28T22:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118692 7.1 false false

CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands by embedding shell metacharacters in web link URLs. When the non-default Custom Web Link Clicked Action option is enabled, attackers can supply crafted…

https://threatroundup.com/cve/cve-2026-118690/ 2026-10-28T22:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-118690 9.3 false false

Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator tokens, and create persistent…

https://threatroundup.com/cve/cve-2026-118689/ 2026-10-28T22:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118689 8.7 false false

OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers to stall connections by sending payload_length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open indefinitely and…

https://threatroundup.com/cve/cve-2026-118682/ 2026-10-28T22:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118682 7.7 false false

KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver…

https://threatroundup.com/cve/cve-2026-76418/ 2026-10-28T20:18:47+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-76418 8.6 true false

A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting…

https://threatroundup.com/cve/cve-2026-13451/ 2026-10-28T20:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-13451 7.7 false false

A flaw was found in KServe. A namespace-scoped user with create/update permissions on InferenceService custom resources can exploit this vulnerability by providing a malicious `storageUri`. This Server-Side Request Forgery (SSRF) vulnerability allows the `storage-initializer` init container to issue arbitrary outbound…

https://threatroundup.com/cve/cve-2026-117574/ 2026-10-28T20:17:21+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-117574 9.1 false false

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials from…

https://threatroundup.com/cve/cve-2026-109411/ 2026-10-28T20:17:17+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109411 8.1 false false

An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests…

https://threatroundup.com/cve/cve-2026-118688/ 2026-10-28T19:17:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118688 8.8 false false

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBSD hosts to follow directory symlinks. A guest with sandbox write access can rename a…

https://threatroundup.com/cve/cve-2026-118686/ 2026-10-28T19:17:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118686 8.7 false false

EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number…

https://threatroundup.com/cve/cve-2026-118683/ 2026-10-28T19:17:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118683 8.6 false false

MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a bundle's configs/logging.conf to logging.config.fileConfig that eval()s handler class and args fields. Attackers can publish a malicious bundle whose logging.conf runs arbitrary Python at workflow…

https://threatroundup.com/cve/cve-2026-118679/ 2026-10-28T19:17:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118679 6.9 false false

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauthenticated attackers to exfiltrate Slack tokens by bypassing signature verification when no signing secret is set. Attackers who know the webhook…

https://threatroundup.com/cve/cve-2026-118678/ 2026-10-28T19:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118678 7.1 false false

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows with specially named connection keys. Attackers can add keys such as __proto__ to workflow connections, which…

https://threatroundup.com/cve/cve-2026-118676/ 2026-10-28T19:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118676 5.1 false false

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted…

https://threatroundup.com/cve/cve-2026-118675/ 2026-10-28T19:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118675 5.1 false false

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url…

https://threatroundup.com/cve/cve-2026-118649/ 2026-10-28T19:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118649 8.7 false false

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An…

https://threatroundup.com/cve/cve-2026-118648/ 2026-10-28T19:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118648 8.4 false false

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability because some webhook response paths, such as error responses and responses without headers, omit the sandbox Content-Security-Policy. Authenticated members who can create and activate…

https://threatroundup.com/cve/cve-2026-118647/ 2026-10-28T19:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118647 5.3 false false

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential…

https://threatroundup.com/cve/cve-2026-118645/ 2026-10-28T19:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118645 7 false false

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick Base node, which sends the Where filter to the Quick Base API as raw query text. Attackers supplying untrusted input such as…

https://threatroundup.com/cve/cve-2026-118644/ 2026-10-28T19:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118644 5.1 false false

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an…

https://threatroundup.com/cve/cve-2026-118643/ 2026-10-28T19:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118643 5.3 false false

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but…

https://threatroundup.com/cve/cve-2026-118642/ 2026-10-28T19:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118642 5.1 false false

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON…

https://threatroundup.com/cve/cve-2026-118641/ 2026-10-28T19:17:31+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-118641 6.9 false false

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in the Microsoft Outlook contact lookup and Microsoft SharePoint v1 item update nodes, which build $filter string literals from expression-bindable parameters without escaping. Attackers…

https://threatroundup.com/cve/cve-2026-84725/ 2026-10-28T18:17:20+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-84725 8.1 false false

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors…

https://threatroundup.com/cve/cve-2026-106079/ 2026-10-28T17:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-106079 8.8 false false

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root…

https://threatroundup.com/cve/cve-2026-103411/ 2026-10-28T17:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103411 7.1 false false

An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.

https://threatroundup.com/cve/cve-2026-103410/ 2026-10-28T17:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103410 7.5 false false

An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.

https://threatroundup.com/cve/cve-2026-103409/ 2026-10-28T17:17:27+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-103409 9.8 false false

A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vulnerability can only…

https://threatroundup.com/cve/cve-2026-103408/ 2026-10-28T17:17:26+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103408 8.8 false false

A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.

https://threatroundup.com/cve/cve-2026-103407/ 2026-10-28T17:17:26+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103407 8.8 false false

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the…

https://threatroundup.com/cve/cve-2026-103406/ 2026-10-28T17:17:25+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-103406 9.8 false false

An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

https://threatroundup.com/cve/cve-2026-103403/ 2026-10-28T17:17:24+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103403 8.8 false false

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via…

https://threatroundup.com/cve/cve-2026-103402/ 2026-10-28T17:17:24+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103402 8.8 false false

An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing…

https://threatroundup.com/cve/cve-2026-103401/ 2026-10-28T17:17:24+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-103401 8.8 false false

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API…

https://threatroundup.com/cve/cve-2026-67187/ 2026-10-28T16:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-67187 5.1 false false

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method…

https://threatroundup.com/cve/cve-2026-112357/ 2026-10-28T16:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112357 8.5 false false

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can…

https://threatroundup.com/cve/cve-2026-92797/ 2026-10-28T08:16:30+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-92797 8.8 false false

The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, allowing…

https://threatroundup.com/cve/cve-2026-111120/ 2026-10-28T07:16:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111120 8.8 false false

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.8. This is due to missing or incorrect nonce validation on the condtext_update_tmpl function. This makes it possible…

https://threatroundup.com/cve/cve-2026-111111/ 2026-10-28T07:16:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111111 7.2 false false

The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and…

https://threatroundup.com/cve/cve-2026-110662/ 2026-10-28T07:16:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110662 7.2 false false

The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping.…

https://threatroundup.com/cve/cve-2026-109384/ 2026-10-28T07:16:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109384 8.8 false false

The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the filterFiletypeAndExt function. This is due to insufficient file type validation due to the absence…

https://threatroundup.com/cve/cve-2026-109381/ 2026-10-28T07:16:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109381 7.2 false false

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably…

https://threatroundup.com/cve/cve-2026-109218/ 2026-10-28T07:16:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-109218 9.8 false false

The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a…

https://threatroundup.com/cve/cve-2026-15323/ 2026-10-28T06:16:36+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-15323 7.5 false false

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of…

https://threatroundup.com/cve/cve-2026-1928/ 2026-10-28T04:18:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-1928 8.8 false false

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint.…

https://threatroundup.com/cve/cve-2026-116613/ 2026-10-28T04:17:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116613 7.5 false false

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atb_shortcode_handler() function fetching an arbitrary post by attacker-supplied ID and, in…

https://threatroundup.com/cve/cve-2026-111255/ 2026-10-28T04:17:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111255 7.5 false false

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.9.2 via the upload_image function. This is due to insufficient file type validation in upload_image…

https://threatroundup.com/cve/cve-2026-97019/ 2026-10-28T03:17:16+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-97019 7.2 false false

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it…

https://threatroundup.com/cve/cve-2026-84999/ 2026-10-28T03:17:16+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-84999 9.8 false false

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext…

https://threatroundup.com/cve/cve-2026-118378/ 2026-10-28T03:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118378 8.5 false false

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the…

https://threatroundup.com/cve/cve-2026-118377/ 2026-10-28T03:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-118377 8.7 false false

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status,…

https://threatroundup.com/cve/cve-2026-118375/ 2026-10-28T03:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-118375 9.2 false false

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into…

https://threatroundup.com/cve/cve-2026-117609/ 2026-10-28T03:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117609 7.1 false false

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply…

https://threatroundup.com/cve/cve-2026-117607/ 2026-10-28T03:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117607 8.6 false false

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via import_language.php containing a .inc file, then request…

https://threatroundup.com/cve/cve-2026-111314/ 2026-10-28T03:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111314 7.2 false false

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes…

https://threatroundup.com/cve/cve-2026-109999/ 2026-10-28T03:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109999 7.2 false false

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to,…

https://threatroundup.com/cve/cve-2015-20129/ 2026-10-28T03:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2015-20129 8.6 false false

CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions because CSRF protection is disabled by default. Attackers can lure an authenticated administrator to a malicious page that submits POST requests to commands like…

https://threatroundup.com/cve/cve-2014-125138/ 2026-10-28T03:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2014-125138 8.7 false false

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image…

https://threatroundup.com/cve/cve-2013-20007/ 2026-10-28T03:17:07+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2013-20007 8.6 false false

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and…

https://threatroundup.com/cve/cve-2026-106013/ 2026-10-28T02:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-106013 9.8 false false

The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callback function because after exchanging the visitor's oauth_verifier for…

https://threatroundup.com/cve/cve-2026-62765/ 2026-10-27T22:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-62765 7.5 false false

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-85898/ 2026-10-27T21:19:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-85898 8.8 false false

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-83831/ 2026-10-27T21:19:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-83831 8.8 false false

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

https://threatroundup.com/cve/cve-2026-112355/ 2026-10-27T20:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112355 8.7 false false

The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows unauthenticated attackers to access member-only content through the WordPress REST API. Because the filter that strips protected content for non-members is only attached during normal front-end…

https://threatroundup.com/cve/cve-2026-112352/ 2026-10-27T20:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-112352 9.1 false false

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity…

https://threatroundup.com/cve/cve-2026-112351/ 2026-10-27T20:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112351 8.7 false false

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters.…

https://threatroundup.com/cve/cve-2026-112350/ 2026-10-27T20:17:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112350 8.7 false false

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use…

https://threatroundup.com/cve/cve-2026-117516/ 2026-10-27T18:17:36+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117516 5.5 false false

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely.…

https://threatroundup.com/cve/cve-2026-117515/ 2026-10-27T18:17:36+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117515 5.5 false false

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-48379/ 2026-10-27T17:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-48379 7.8 false false

Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious…

https://threatroundup.com/cve/cve-2026-48360/ 2026-10-27T17:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-48360 9.6 false false

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation…

https://threatroundup.com/cve/cve-2026-117514/ 2026-10-27T17:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117514 5.5 false false

A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/ticket_id/emp_id/salary_id/page_id leads to sql injection. It is possible to initiate the attack…

https://threatroundup.com/cve/cve-2026-117513/ 2026-10-27T17:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117513 5.5 false false

A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from…

https://threatroundup.com/cve/cve-2026-117512/ 2026-10-27T17:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117512 5.5 false false

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employee_insert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-113775/ 2026-10-27T17:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-113775 7.8 false false

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this…

https://threatroundup.com/cve/cve-2026-112353/ 2026-10-27T17:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-112353 6.2 false false

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that…

https://threatroundup.com/cve/cve-2026-105781/ 2026-10-27T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-105781 10 false false

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this…

https://threatroundup.com/cve/cve-2026-105780/ 2026-10-27T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-105780 9.9 false false

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue…

https://threatroundup.com/cve/cve-2026-105779/ 2026-10-27T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-105779 9.1 false false

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures…

https://threatroundup.com/cve/cve-2026-105489/ 2026-10-27T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-105489 9.9 false false

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit…

https://threatroundup.com/cve/cve-2026-104354/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-104354 9.1 false false

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges…

https://threatroundup.com/cve/cve-2026-104353/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-104353 9.9 false false

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could…

https://threatroundup.com/cve/cve-2026-104351/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-104351 9.9 false false

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute…

https://threatroundup.com/cve/cve-2026-104350/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-104350 9.3 false false

Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation…

https://threatroundup.com/cve/cve-2026-104349/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-104349 7.3 false false

Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this…

https://threatroundup.com/cve/cve-2026-102638/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-102638 7.1 false false

A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A…

https://threatroundup.com/cve/cve-2026-102637/ 2026-10-27T17:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-102637 7.1 false false

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor…

https://threatroundup.com/cve/cve-2026-102636/ 2026-10-27T17:16:54+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-102636 7.1 false false

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to…

https://threatroundup.com/cve/cve-2026-117511/ 2026-10-27T16:17:31+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-117511 5.5 false false

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The…

https://threatroundup.com/cve/cve-2026-107672/ 2026-10-27T16:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-107672 8.8 false false

A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post Processor Utility Extension. A malicious actor may exploit this vulnerability to execute arbitrary commands in the context of the current user.

https://threatroundup.com/cve/cve-2026-117604/ 2026-10-27T15:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117604 8.7 false false

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records…

https://threatroundup.com/cve/cve-2026-117602/ 2026-10-27T14:16:40+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117602 8.6 false false

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write…

https://threatroundup.com/cve/cve-2026-117601/ 2026-10-27T14:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-117601 9.3 false false

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an…

https://threatroundup.com/cve/cve-2026-117573/ 2026-10-27T14:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117573 8.5 false false

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated…

https://threatroundup.com/cve/cve-2026-117569/ 2026-10-27T14:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117569 8.5 false false

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist,…

https://threatroundup.com/cve/cve-2026-117568/ 2026-10-27T14:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117568 7.3 false false

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote…

https://threatroundup.com/cve/cve-2026-117567/ 2026-10-27T14:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117567 8.5 false false

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path,…

https://threatroundup.com/cve/cve-2026-117564/ 2026-10-27T14:16:38+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-117564 9.3 false false

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user…

https://threatroundup.com/cve/cve-2026-117561/ 2026-10-27T14:16:38+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117561 8.5 false false

Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted Salesforce CLI tool flag values. Because escapeValue() in src/utils.ts fails to neutralize backticks, $() substitution, and other shell metacharacters, these…

https://threatroundup.com/cve/cve-2026-117560/ 2026-10-27T14:16:38+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117560 8.5 false false

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick…

https://threatroundup.com/cve/cve-2026-117559/ 2026-10-27T14:16:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117559 8.5 false false

DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command allowlist by using $(...) or backtick substitution. Attackers, including prompt-injected agents, can inject commands through parameters interpolated into Device.run_shell() or unvalidated Device.list_directory() to…

https://threatroundup.com/cve/cve-2026-117558/ 2026-10-27T14:16:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117558 8.5 false false

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr…

https://threatroundup.com/cve/cve-2026-117553/ 2026-10-27T14:16:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117553 7.7 false false

Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them…

https://threatroundup.com/cve/cve-2026-92546/ 2026-10-27T13:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-92546 7.5 false false

Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass. This issue affects Agentic AI / Agentic Ally: before 0ef61f2e.

https://threatroundup.com/cve/cve-2026-100164/ 2026-10-27T13:16:54+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-100164 7.5 false false

Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.

https://threatroundup.com/cve/cve-2026-109995/ 2026-10-27T12:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109995 7.2 false false

The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This…

https://threatroundup.com/cve/cve-2026-117540/ 2026-10-27T11:17:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117540 8.7 false false

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes…

https://threatroundup.com/cve/cve-2026-117536/ 2026-10-27T11:17:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-117536 8.6 false false

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it.…

https://threatroundup.com/cve/cve-2026-117532/ 2026-10-27T11:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-117532 9.3 false true

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like…

https://threatroundup.com/cve/cve-2026-116898/ 2026-10-27T11:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116898 7.1 false false

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into…

https://threatroundup.com/cve/cve-2026-116896/ 2026-10-27T11:17:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116896 7.7 false false

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and…

https://threatroundup.com/cve/cve-2026-116890/ 2026-10-27T11:17:31+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116890 6.9 false false

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs…

https://threatroundup.com/cve/cve-2026-116880/ 2026-10-27T11:17:30+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116880 7.1 false false

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,…

https://threatroundup.com/cve/cve-2026-116878/ 2026-10-27T11:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116878 8.7 false false

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL LIMIT and…

https://threatroundup.com/cve/cve-2026-116876/ 2026-10-27T11:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116876 7.1 false false

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the…

https://threatroundup.com/cve/cve-2026-116873/ 2026-10-27T11:17:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116873 6.9 false false

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute…

https://threatroundup.com/cve/cve-2026-116872/ 2026-10-27T11:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116872 8.7 false false

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP…

https://threatroundup.com/cve/cve-2026-116871/ 2026-10-27T11:17:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116871 8.7 false false

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying…

https://threatroundup.com/cve/cve-2026-92885/ 2026-10-27T09:16:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-92885 9.8 false false

The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 2.0.6.2 via the qode_membership_check_facebook_user AJAX action. This is due to a typographic error in the Facebook OAuth token…

https://threatroundup.com/cve/cve-2026-75891/ 2026-10-27T07:16:32+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-75891 8.8 false false

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher due to a missing…

https://threatroundup.com/cve/cve-2026-111820/ 2026-10-27T06:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111820 7.2 false false

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes…

https://threatroundup.com/cve/cve-2026-116843/ 2026-10-27T01:19:07+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116843 8.7 false false

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean,…

https://threatroundup.com/cve/cve-2026-116816/ 2026-10-27T01:19:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116816 8.5 false false

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like whose negative parsed value writes token ids before the bytes_…

https://threatroundup.com/cve/cve-2026-116623/ 2026-10-27T01:19:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116623 5.5 false false

A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched…

https://threatroundup.com/cve/cve-2026-116620/ 2026-10-27T01:19:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116620 5.5 false false

A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The…

https://threatroundup.com/cve/cve-2024-58400/ 2026-10-27T01:19:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2024-58400 8.8 false false

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to…

https://threatroundup.com/cve/cve-2026-116819/ 2026-10-27T00:17:16+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116819 8.4 false false

OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization…

https://threatroundup.com/cve/cve-2026-116818/ 2026-10-27T00:17:16+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116818 8.8 false false

OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to…

https://threatroundup.com/cve/cve-2026-116811/ 2026-10-27T00:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116811 8.7 false false

OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it…

https://threatroundup.com/cve/cve-2026-116808/ 2026-10-27T00:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116808 8.6 false false

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id…

https://threatroundup.com/cve/cve-2026-116748/ 2026-10-26T22:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116748 8.7 false false

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue…

https://threatroundup.com/cve/cve-2026-116747/ 2026-10-26T22:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116747 9.2 false false

Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge session tokens by using the hardcoded DUMMY_SECRET fallback key. When KENER_SECRET_KEY is empty or unset, attackers knowing an administrator email can sign a kener-user cookie…

https://threatroundup.com/cve/cve-2026-116738/ 2026-10-26T22:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116738 8.7 false false

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b'…

https://threatroundup.com/cve/cve-2026-116724/ 2026-10-26T22:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116724 8.5 false false

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past…

https://threatroundup.com/cve/cve-2026-116723/ 2026-10-26T22:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116723 8.5 false false

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte…

https://threatroundup.com/cve/cve-2026-116508/ 2026-10-26T22:16:54+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116508 9.3 false false

A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function sub_402340 of the file infostat.cgi of the component Device-Information CGI. Performing a manipulation of the argument CONTENT_LENGTH results in stack-based buffer overflow. Remote…

https://threatroundup.com/cve/cve-2026-116506/ 2026-10-26T21:18:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116506 8.6 false false

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected is the function apmib_set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

https://threatroundup.com/cve/cve-2026-116505/ 2026-10-26T21:18:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116505 8.5 false false

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched remotely. The…

https://threatroundup.com/cve/cve-2026-116504/ 2026-10-26T21:18:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116504 8.6 false false

A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_modules/upgrade.so of the component Cloud Upgrade. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The…

https://threatroundup.com/cve/cve-2014-125135/ 2026-10-26T20:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2014-125135 6.9 false false

A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to…

https://threatroundup.com/cve/cve-2026-33521/ 2026-10-26T18:17:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-33521 7.5 false false

There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to…

https://threatroundup.com/cve/cve-2026-10757/ 2026-10-26T18:17:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-10757 9.8 false false

There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in a…

https://threatroundup.com/cve/cve-2026-116543/ 2026-10-26T16:17:19+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116543 8.7 false false

Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network…

https://threatroundup.com/cve/cve-2026-116489/ 2026-10-26T16:17:18+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116489 7.7 false false

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects, then build and query…

https://threatroundup.com/cve/cve-2026-116368/ 2026-10-26T16:17:18+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116368 6.9 false false

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted…

https://threatroundup.com/cve/cve-2026-112346/ 2026-10-26T16:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-112346 9.3 false false

OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers…

https://threatroundup.com/cve/cve-2026-112343/ 2026-10-26T16:17:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112343 8.6 false false

Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to evade per-path permission overrides by exploiting case-insensitive filesystem path resolution and 8.3 short names. Attackers can address a protected directory using alternate capitalization or…

https://threatroundup.com/cve/cve-2026-116339/ 2026-10-26T15:16:39+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116339 5.5 false false

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec_ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has been…

https://threatroundup.com/cve/cve-2026-112345/ 2026-10-26T15:16:38+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112345 8.6 false false

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover…

https://threatroundup.com/cve/cve-2026-116485/ 2026-10-26T14:16:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116485 9.3 false true

danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set ADMIN_TOKEN,…

https://threatroundup.com/cve/cve-2026-116219/ 2026-10-26T14:16:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116219 8.6 false false

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system…

https://threatroundup.com/cve/cve-2026-116218/ 2026-10-26T14:16:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116218 7.2 false false

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped…

https://threatroundup.com/cve/cve-2026-116214/ 2026-10-26T14:16:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116214 9.3 false false

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset…

https://threatroundup.com/cve/cve-2026-94380/ 2026-10-26T12:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-94380 8.1 false false

Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc. Liman MYS allows Password Recovery Exploitation. This issue affects Liman MYS: from 2.3.4-1124 before 2.3.5-1131.

https://threatroundup.com/cve/cve-2026-116260/ 2026-10-26T12:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116260 5.5 false false

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote.…

https://threatroundup.com/cve/cve-2026-115717/ 2026-10-26T12:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115717 6.3 false false

Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API endpoint, which lacks the has_page_write access control applied to similar asset-ingest handlers and performs an unprotected requests.get call that follows redirects without re-validating resolved IP…

https://threatroundup.com/cve/cve-2026-116257/ 2026-10-26T11:16:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116257 5.5 false false

A vulnerability was determined in BillaBear up to 2025.01.03. Affected by this issue is the function processInstall of the file src/BillaBear/Controller/InstallController.php of the component Installation Handler. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The exploit…

https://threatroundup.com/cve/cve-2026-116256/ 2026-10-26T11:16:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116256 5.5 false false

A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side request forgery.…

https://threatroundup.com/cve/cve-2026-116253/ 2026-10-26T10:16:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116253 6.9 false false

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

https://threatroundup.com/cve/cve-2026-116237/ 2026-10-26T10:16:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116237 8.5 false false

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and…

https://threatroundup.com/cve/cve-2026-116236/ 2026-10-26T09:16:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116236 7.3 false false

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload.…

https://threatroundup.com/cve/cve-2026-116235/ 2026-10-26T09:16:35+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116235 8.5 false false

A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The…

https://threatroundup.com/cve/cve-2026-116234/ 2026-10-26T09:16:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116234 8.5 false false

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched…

https://threatroundup.com/cve/cve-2026-116233/ 2026-10-26T09:16:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116233 8.5 false false

A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-116232/ 2026-10-26T08:17:17+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116232 8.6 false false

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack…

https://threatroundup.com/cve/cve-2026-116231/ 2026-10-26T08:17:17+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116231 8.6 false false

A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unknown function of the component Ser2net. Performing a manipulation of the argument regmsg results in crlf injection. It is possible to initiate the…

https://threatroundup.com/cve/cve-2026-116117/ 2026-10-26T05:17:54+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116117 5.5 false false

A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the function run.halo.app.theme.DefaultViewNameResolver.resolveViewNameOrDefault of the file application/src/main/java/run/halo/app/theme/DefaultViewNameResolver.java of the component View Name Resolver. Executing a manipulation of the argument template can lead to path…

https://threatroundup.com/cve/cve-2026-116116/ 2026-10-26T04:17:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116116 8.4 false false

A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function of the component Secure Boot. Performing a manipulation results in improper verification of cryptographic signature. The attack needs to be approached locally. The exploit is now…

https://threatroundup.com/cve/cve-2026-116112/ 2026-10-26T03:17:11+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116112 5.5 false false

A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d. The affected element is an unknown function of the file admin/add-new.php. The manipulation of the argument spec leads to sql injection. It is possible to initiate the attack remotely. The…

https://threatroundup.com/cve/cve-2026-116110/ 2026-10-26T03:17:11+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116110 5.5 false false

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out…

https://threatroundup.com/cve/cve-2026-116106/ 2026-10-26T02:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116106 6.9 false true

A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. Affected by this vulnerability is an unknown functionality of the component FileProvider. The manipulation leads to improper access controls. The attack may be initiated remotely. The vendor was…

https://threatroundup.com/cve/cve-2026-116094/ 2026-10-25T22:16:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116094 5.5 false false

A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly…

https://threatroundup.com/cve/cve-2026-116062/ 2026-10-25T18:16:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116062 5.5 false false

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the argument Contact results in sql injection. The attack may be launched remotely. The exploit…

https://threatroundup.com/cve/cve-2026-116061/ 2026-10-25T18:16:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116061 5.5 false false

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Contact leads to sql injection. The attack may be initiated remotely. The exploit is publicly available…

https://threatroundup.com/cve/cve-2026-116060/ 2026-10-25T17:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116060 5.5 false false

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact can lead to sql injection. The attack can be launched remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-116211/ 2026-10-25T14:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116211 8.8 false false

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate…

https://threatroundup.com/cve/cve-2026-116208/ 2026-10-25T14:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116208 7.2 false false

YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete,…

https://threatroundup.com/cve/cve-2026-116207/ 2026-10-25T14:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116207 8.8 false false

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with…

https://threatroundup.com/cve/cve-2026-116204/ 2026-10-25T14:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116204 7.2 false false

YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an…

https://threatroundup.com/cve/cve-2026-116201/ 2026-10-25T14:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116201 8.7 false false

Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can send concurrent POST requests to /saml/acs with one captured assertion to…

https://threatroundup.com/cve/cve-2026-116199/ 2026-10-25T14:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116199 9.2 false false

Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the activated flag. Deactivated users with email-shaped usernames and still-live Google identities can sign in via Google…

https://threatroundup.com/cve/cve-2026-116191/ 2026-10-25T14:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116191 8.7 false true

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT,…

https://threatroundup.com/cve/cve-2026-116189/ 2026-10-25T14:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116189 7.7 false false

rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers controlling the release distribution path can prepend an unsigned checksum line matching a malicious archive,…

https://threatroundup.com/cve/cve-2026-116183/ 2026-10-25T14:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116183 8.7 false false

phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA can rewrite question categories, forge answered entries in…

https://threatroundup.com/cve/cve-2026-116180/ 2026-10-25T14:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116180 8.3 false false

vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/outputs.py allocates an uninitialized int32 tensor, and the V1 model runner leaves prompt positions reported as computed by a KV connector unwritten. A client sharing the engine…

https://threatroundup.com/cve/cve-2026-116179/ 2026-10-25T14:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116179 8.7 false false

vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through media_io_kwargs. Attackers can set num_frames to -1 with a large inline video so VideoMediaIO.load_base64 decodes every…

https://threatroundup.com/cve/cve-2026-116177/ 2026-10-25T14:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116177 8.7 false false

vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None. Attackers can submit a pathological decompression-bomb image to /v1/chat/completions to OOM-kill the worker…

https://threatroundup.com/cve/cve-2026-116176/ 2026-10-25T14:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116176 8.8 false false

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host,…

https://threatroundup.com/cve/cve-2026-116171/ 2026-10-25T14:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116171 8.7 false false

SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and matches no forbidden prefix. Authenticated API callers can prepend the prefix to localPath in /api/import/importStdMd to copy workspace…

https://threatroundup.com/cve/cve-2026-116163/ 2026-10-25T14:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116163 9.1 false false

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can…

https://threatroundup.com/cve/cve-2026-116149/ 2026-10-25T14:16:53+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116149 7.2 false false

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

https://threatroundup.com/cve/cve-2026-116068/ 2026-10-25T12:16:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116068 8.7 false false

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables…

https://threatroundup.com/cve/cve-2026-116067/ 2026-10-25T12:16:28+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116067 8.8 false true

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file…

https://threatroundup.com/cve/cve-2026-116050/ 2026-10-25T09:16:27+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116050 5.5 false false

A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be…

https://threatroundup.com/cve/cve-2026-116049/ 2026-10-25T09:16:27+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116049 5.5 false false

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/cpi/semester/experience can lead to sql injection.…

https://threatroundup.com/cve/cve-2026-116048/ 2026-10-25T08:16:26+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116048 5.5 false false

A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible…

https://threatroundup.com/cve/cve-2026-116006/ 2026-10-25T04:17:34+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116006 5.5 false false

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can…

https://threatroundup.com/cve/cve-2026-116000/ 2026-10-25T03:16:26+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-116000 5.5 false false

A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in server-side request forgery. It is…

https://threatroundup.com/cve/cve-2026-115999/ 2026-10-25T02:16:26+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115999 6.9 false false

A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling…

https://threatroundup.com/cve/cve-2026-115995/ 2026-10-24T23:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115995 9.4 false false

A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection.…

https://threatroundup.com/cve/cve-2026-115973/ 2026-10-24T19:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115973 6.9 false false

A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about…

https://threatroundup.com/cve/cve-2026-114820/ 2026-10-24T19:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-114820 9.1 false true

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for…

https://threatroundup.com/cve/cve-2026-115970/ 2026-10-24T18:16:48+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115970 5.5 false false

A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-115969/ 2026-10-24T16:16:25+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115969 5.5 false false

A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been…

https://threatroundup.com/cve/cve-2026-116019/ 2026-10-24T12:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116019 8.7 false false

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides…

https://threatroundup.com/cve/cve-2026-116016/ 2026-10-24T12:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116016 7.1 false false

yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or…

https://threatroundup.com/cve/cve-2026-116014/ 2026-10-24T12:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-116014 9.2 false false

open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients…

https://threatroundup.com/cve/cve-2026-116011/ 2026-10-24T12:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116011 8.7 false true

Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread…

https://threatroundup.com/cve/cve-2026-116009/ 2026-10-24T12:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-116009 8.7 false false

Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the name parameter. Attackers can send a base64 data: URI to the crop_url media…

https://threatroundup.com/cve/cve-2026-110018/ 2026-10-24T12:16:54+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110018 8.8 false false

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.17.0 via the `/ablocks/v1/form-builder/registration` REST endpoint. The vulnerability exists because…

https://threatroundup.com/cve/cve-2026-115807/ 2026-10-24T05:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115807 7.1 false false

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block…

https://threatroundup.com/cve/cve-2026-115806/ 2026-10-24T05:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115806 9.8 false false

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker can store…

https://threatroundup.com/cve/cve-2026-112342/ 2026-10-23T19:17:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112342 7.1 false false

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the…

https://threatroundup.com/cve/cve-2026-110975/ 2026-10-23T18:17:20+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110975 7.4 false false

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — serialized datasource objects using a default Gson…

https://threatroundup.com/cve/cve-2026-115810/ 2026-10-23T17:17:21+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115810 6.3 false false

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in…

https://threatroundup.com/cve/cve-2026-57845/ 2026-10-23T16:16:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-57845 8.7 false true

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle file loaded through the deprecated pandas packaged builder. Attackers can supply a pickle-backed dataset that is processed…

https://threatroundup.com/cve/cve-2026-115728/ 2026-10-23T13:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115728 8.7 false false

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic…

https://threatroundup.com/cve/cve-2026-115727/ 2026-10-23T12:18:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115727 9.2 false false

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating…

https://threatroundup.com/cve/cve-2026-115726/ 2026-10-23T12:18:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115726 8.5 false false

Aider through 0.86.2 contains a command execution vulnerability that allows attackers to run shell commands by committing a malicious .aider.conf.yml that is auto-loaded without a trust prompt. Attackers can set notifications-command or editor values that are executed via subprocess with…

https://threatroundup.com/cve/cve-2026-115723/ 2026-10-23T12:18:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115723 8.3 false false

Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive partner that allows a malicious active partner to overflow application buffers by declaring an unvalidated BSend total length. Attackers connecting from the configured peer address can declare up to…

https://threatroundup.com/cve/cve-2026-93489/ 2026-10-23T08:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-93489 8.7 false false

Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations. Refer to the ' Security Update for ASUS Router Firmware '…

https://threatroundup.com/cve/cve-2026-75779/ 2026-10-23T08:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-75779 8.6 false false

Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request Forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to…

https://threatroundup.com/cve/cve-2026-75775/ 2026-10-23T08:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-75775 7.7 false false

Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to…

https://threatroundup.com/cve/cve-2026-115497/ 2026-10-23T05:17:15+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115497 7.5 false false

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary…

https://threatroundup.com/cve/cve-2026-109198/ 2026-10-23T05:17:14+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-109198 7.2 false false

The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes…

https://threatroundup.com/cve/cve-2026-115486/ 2026-10-23T01:16:53+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115486 7.1 false false

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from…

https://threatroundup.com/cve/cve-2026-115484/ 2026-10-23T01:16:53+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115484 7.6 false false

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network…

https://threatroundup.com/cve/cve-2026-97785/ 2026-10-22T22:20:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-97785 10 false false

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-83938/ 2026-10-22T22:19:18+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-83938 10 false false

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-108456/ 2026-10-22T22:17:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-108456 7.7 false false

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

https://threatroundup.com/cve/cve-2026-114625/ 2026-10-22T21:17:16+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-114625 9.4 true false

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data…

https://threatroundup.com/cve/cve-2026-115506/ 2026-10-22T20:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115506 8.7 false false

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume…

https://threatroundup.com/cve/cve-2026-115505/ 2026-10-22T20:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115505 7.2 false false

libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR decoder in lib/dcerpc.c that allow heap out-of-bounds reads and writes. A malicious SMB server or machine-in-the-middle on unsigned connections can send crafted NetrShareEnum replies with wrapping actual_count or max_count…

https://threatroundup.com/cve/cve-2026-115504/ 2026-10-22T20:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115504 8.5 false false

CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string…

https://threatroundup.com/cve/cve-2026-112332/ 2026-10-22T20:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112332 8.7 false false

Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who can publish to a consumed queue or topic to crash the service permanently by sending structurally valid JSON that does not match the handler's…

https://threatroundup.com/cve/cve-2026-112331/ 2026-10-22T20:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112331 8.7 false false

Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a remote attacker who can produce records to a consumed topic to crash the service permanently by sending a single crafted record. By setting the content-type header to application/cloudevents+json and omitting…

https://threatroundup.com/cve/cve-2026-112330/ 2026-10-22T20:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112330 8.7 false false

Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a remote attacker who can publish to a consumed queue to crash the service permanently by sending a message with crafted cloudEvents headers. Attackers can supply an invalid cloudEvents:motorversion,…

https://threatroundup.com/cve/cve-2026-115392/ 2026-10-22T19:17:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115392 8.8 false false

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mishandles symlinks with trailing slashes on macOS and Linux kernels lacking openat2. A guest with write…

https://threatroundup.com/cve/cve-2026-115384/ 2026-10-22T19:17:45+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115384 9.4 false false

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions…

https://threatroundup.com/cve/cve-2026-115377/ 2026-10-22T19:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115377 9.4 false false

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with…

https://threatroundup.com/cve/cve-2026-115376/ 2026-10-22T19:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115376 8.3 false false

Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy…

https://threatroundup.com/cve/cve-2026-115375/ 2026-10-22T19:17:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115375 9.4 false false

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files.…

https://threatroundup.com/cve/cve-2026-115374/ 2026-10-22T19:17:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115374 7.1 false false

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verification flaw in its built-in S3 server that allows presigned URL holders to inject unsigned x-amz-* headers. Attackers can add an unsigned X-Amz-Copy-Source header to a presigned upload URL…

https://threatroundup.com/cve/cve-2026-115372/ 2026-10-22T19:17:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115372 9 false false

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move…

https://threatroundup.com/cve/cve-2026-115371/ 2026-10-22T19:17:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115371 7.1 false false

Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability that allows restricted TLS clients to read storage bucket keys in the default project. Attackers can query the bucket keys endpoints to obtain S3…

https://threatroundup.com/cve/cve-2026-115355/ 2026-10-22T19:17:41+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115355 8.7 false false

Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to…

https://threatroundup.com/cve/cve-2026-115353/ 2026-10-22T19:17:41+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115353 9.2 false false

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to…

https://threatroundup.com/cve/cve-2026-115352/ 2026-10-22T19:17:41+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115352 8.7 false false

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O(N^2) parse_link_text and parse_link_label…

https://threatroundup.com/cve/cve-2026-115349/ 2026-10-22T19:17:40+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115349 8.7 false false

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parse_link_text function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted requests.

https://threatroundup.com/cve/cve-2026-115348/ 2026-10-22T19:17:40+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115348 8.7 false false

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many unbalanced '[' or '![' characters, forcing repeated…

https://threatroundup.com/cve/cve-2026-115347/ 2026-10-22T19:17:40+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115347 8.7 false false

Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html(), triggering repeated forward scans…

https://threatroundup.com/cve/cve-2022-51026/ 2026-10-22T19:17:30+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2022-51026 9.3 false false

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server…

https://threatroundup.com/cve/cve-2026-97631/ 2026-10-22T17:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-97631 9.5 false true

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact…

https://threatroundup.com/cve/cve-2026-115513/ 2026-10-22T17:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115513 6.3 false false

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated user to inject HTML/JavaScript payloads by setting a Candidate, Company, Contact, Job Order, or List name/title field, which is stored unsanitized and later rendered unescaped in…

https://threatroundup.com/cve/cve-2026-104068/ 2026-10-22T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-104068 8.6 false true

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive…

https://threatroundup.com/cve/cve-2026-111497/ 2026-10-22T14:17:37+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-111497 9.2 true true

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or…

https://threatroundup.com/cve/cve-2026-115332/ 2026-10-22T11:17:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115332 8.7 false false

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier,…

https://threatroundup.com/cve/cve-2026-115331/ 2026-10-22T11:17:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115331 8.7 false false

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate…

https://threatroundup.com/cve/cve-2026-115330/ 2026-10-22T11:17:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115330 8.7 false false

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify…

https://threatroundup.com/cve/cve-2026-115328/ 2026-10-22T11:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115328 8.7 false false

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data…

https://threatroundup.com/cve/cve-2026-115325/ 2026-10-22T11:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-115325 8.7 false false

Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests to /api/extclients/{network}/{clientid} to replace public…

https://threatroundup.com/cve/cve-2026-115324/ 2026-10-22T11:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-115324 9.2 false false

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation…

https://threatroundup.com/cve/cve-2026-115323/ 2026-10-22T11:17:51+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-115323 6.9 false false

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes…

https://threatroundup.com/cve/cve-2026-111079/ 2026-10-22T11:17:15+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-111079 7.4 false false

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive…

https://threatroundup.com/cve/cve-2025-71434/ 2026-10-22T11:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2025-71434 8.8 false false

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can inject SQL through doc_datefrom/doc_dateto fields and read results via /api/ec/dev/table/counts to extract database…

https://threatroundup.com/cve/cve-2024-58396/ 2026-10-22T11:17:06+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2024-58396 8.7 false false

YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the fileId parameter. Attackers can send GET requests to /cpasm4/plugInManController/downPlugs with ../ sequences in fileId to retrieve system files…

https://threatroundup.com/cve/cve-2024-58393/ 2026-10-22T11:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2024-58393 8.8 false false

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the 'id' parameter. Attackers can send GET requests to /product-details.php with boolean-based, stacked, or time-based SLEEP payloads in 'id'…

https://threatroundup.com/cve/cve-2022-51024/ 2026-10-22T11:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2022-51024 8.7 false false

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration…

https://threatroundup.com/cve/cve-2022-51023/ 2026-10-22T11:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2022-51023 8.8 false false

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error…

https://threatroundup.com/cve/cve-2022-51022/ 2026-10-22T11:17:05+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2022-51022 8.8 false false

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal…

https://threatroundup.com/cve/cve-2022-51021/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2022-51021 8.8 false false

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by supplying an array-form 'id' parameter to /wp-json/notificationx/v1/notification/{id}. Attackers can pass id[1] with crafted SQL, such as time-based SLEEP…

https://threatroundup.com/cve/cve-2021-48017/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-48017 8.7 false false

OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/?op=theme with ../ sequences in style_name to read local files…

https://threatroundup.com/cve/cve-2021-48016/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2021-48016 9.3 false false

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute…

https://threatroundup.com/cve/cve-2021-48015/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-48015 8.7 false false

JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files…

https://threatroundup.com/cve/cve-2021-48014/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2021-48014 9.3 false false

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload…

https://threatroundup.com/cve/cve-2021-48013/ 2026-10-22T11:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-48013 8.7 false false

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files…

https://threatroundup.com/cve/cve-2019-25779/ 2026-10-22T11:17:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2019-25779 8.7 false false

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files…

https://threatroundup.com/cve/cve-2019-25778/ 2026-10-22T11:17:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2019-25778 8.8 false false

SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting SQL through the rlist[] array parameter. Attackers can send GET requests to /comment/api/index.php with crafted rlist[] values using backtick-quoted variables and…

https://threatroundup.com/cve/cve-2018-25439/ 2026-10-22T11:17:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2018-25439 8.7 false false

MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like…

https://threatroundup.com/cve/cve-2018-25438/ 2026-10-22T11:17:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2018-25438 8.7 false false

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter,…

https://threatroundup.com/cve/cve-2017-20289/ 2026-10-22T11:17:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2017-20289 7.7 false false

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the…

https://threatroundup.com/cve/cve-2017-20287/ 2026-10-22T11:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2017-20287 8.7 false false

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to…

https://threatroundup.com/cve/cve-2026-114221/ 2026-10-22T05:16:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-114221 5.9 false false

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in…

https://threatroundup.com/cve/cve-2026-114664/ 2026-10-22T02:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114664 7.1 false false

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from…

https://threatroundup.com/cve/cve-2026-114663/ 2026-10-22T02:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114663 8.6 false false

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,…

https://threatroundup.com/cve/cve-2026-114662/ 2026-10-22T02:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114662 8.6 false false

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to…

https://threatroundup.com/cve/cve-2026-114661/ 2026-10-22T02:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-114661 9 false false

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attackers can send POST or DELETE requests to the gateway tunnel endpoint to…

https://threatroundup.com/cve/cve-2026-114658/ 2026-10-22T02:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114658 8.7 false false

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting super access in page frontmatter, submit it unauthenticated,…

https://threatroundup.com/cve/cve-2026-114656/ 2026-10-22T02:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-114656 6.9 false false

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attackers can reach backends protected by RequireAndVerifyClientCert when a router rule with !Host()…

https://threatroundup.com/cve/cve-2026-114642/ 2026-10-22T02:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114642 7 false false

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the…

https://threatroundup.com/cve/cve-2026-114640/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114640 7 false false

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redirect is disabled alongside auth-tls-pass-certificate-to-upstream, unauthenticated attackers can send Ssl-Client-Verify: SUCCESS with a chosen…

https://threatroundup.com/cve/cve-2026-114639/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114639 7 false false

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate…

https://threatroundup.com/cve/cve-2026-114638/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114638 7 false false

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attackers holding certificates from another host's CA can access a host requiring its own…

https://threatroundup.com/cve/cve-2026-114637/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114637 7 false false

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim…

https://threatroundup.com/cve/cve-2026-114636/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114636 7 false false

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's access-control annotations. Unauthenticated attackers reaching the HTTP entry point with…

https://threatroundup.com/cve/cve-2026-114635/ 2026-10-22T02:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-114635 7 false false

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http pseudo-header over TLS on Go 1.27 builds…

https://threatroundup.com/cve/cve-2026-114577/ 2026-10-22T02:16:55+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-114577 5.5 false false

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payment_type/amount/description/user/uploadimage/full_name/visa_no results in sql injection. The attack may be launched remotely. The exploit has…

https://threatroundup.com/cve/cve-2026-15723/ 2026-10-22T01:16:59+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-15723 8.2 false false

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an…

https://threatroundup.com/cve/cve-2026-114575/ 2026-10-22T01:16:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-114575 9.3 false false

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The…

https://threatroundup.com/cve/cve-2026-112212/ 2026-10-22T01:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-112212 7.5 false false

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect…

https://threatroundup.com/cve/cve-2026-110264/ 2026-10-22T01:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-110264 10 false true

An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have…

https://threatroundup.com/cve/cve-2026-105777/ 2026-10-22T01:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-105777 4.3 false false

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering…

https://threatroundup.com/cve/cve-2026-91403/ 2026-10-21T22:16:50+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-91403 9.1 false true

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for…

https://threatroundup.com/cve/cve-2026-109619/ 2026-10-21T14:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-109619 9.2 true true

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it…

https://threatroundup.com/cve/cve-2026-109618/ 2026-10-21T14:17:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-109618 9.2 true true

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The…

https://threatroundup.com/cve/cve-2026-102764/ 2026-10-15T21:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-102764 9.3 true true

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

https://threatroundup.com/cve/cve-2026-110936/ 2026-10-15T15:17:30+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-110936 8.4 true true

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a…

https://threatroundup.com/cve/cve-2026-106931/ 2026-10-14T05:16:42+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-106931 8.5 true false

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

https://threatroundup.com/cve/cve-2026-110447/ 2026-10-14T03:17:20+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-110447 9.2 true true

Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the…

https://threatroundup.com/cve/cve-2026-97229/ 2026-10-13T02:17:00+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-97229 10 true true

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…

https://threatroundup.com/cve/cve-2026-88779/ 2026-10-04T04:16:43+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-88779 8.7 true false

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

https://threatroundup.com/cve/cve-2026-86950/ 2026-09-28T20:17:11+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-86950 8.8 true true

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary…

https://threatroundup.com/cve/cve-2026-88771/ 2026-09-27T17:16:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-88771 9.5 true true

Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker…

https://threatroundup.com/cve/cve-2026-96656/ 2026-09-23T17:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-96656 8.6 true true

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without…

https://threatroundup.com/cve/cve-2026-96655/ 2026-09-23T17:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-96655 5.3 true false

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

https://threatroundup.com/cve/cve-2026-96654/ 2026-09-23T17:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-96654 6.9 true false

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

https://threatroundup.com/cve/cve-2026-96652/ 2026-09-23T17:17:23+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2026-96652 5.3 true true

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

https://threatroundup.com/cve/cve-2026-80097/ 2026-09-08T18:20:52+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-80097 8.6 false true

Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.

https://threatroundup.com/cve/cve-2026-82078/ 2026-08-28T16:18:31+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-82078 9.4 true true

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker…

https://threatroundup.com/cve/cve-2026-81578/ 2026-08-28T16:18:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-81578 8.8 true true

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows…

https://threatroundup.com/cve/cve-2026-30612/ 2026-08-27T20:17:33+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-30612 9.8 false false

An issue in Time4 Popcorn for Windows

https://threatroundup.com/cve/cve-2026-41709/ 2026-07-30T14:16:57+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Low 1 CVE-2026-41709 2.7 true false

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

https://threatroundup.com/cve/cve-2026-48356/ 2026-07-14T20:17:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-48356 9.3 true true

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.…

https://threatroundup.com/cve/cve-2026-35273/ 2026-06-11T04:16:53+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-35273 9.8 true true

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful…

https://threatroundup.com/cve/cve-2026-46300/ 2026-05-23T12:17:02+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-46300 7.8 true true

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned…

https://threatroundup.com/cve/cve-2026-8467/ 2026-05-20T14:17:04+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-8467 9.5 false true

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation. The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed…

https://threatroundup.com/cve/cve-2026-0257/ 2026-05-13T19:17:01+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2026-0257 7.8 true true

Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.

https://threatroundup.com/cve/cve-2026-20127/ 2026-02-25T17:25:29+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2026-20127 10 true true

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain…

https://threatroundup.com/cve/cve-2025-55182/ 2025-12-03T16:15:56+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2025-55182 10 true true

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.

https://threatroundup.com/cve/cve-2025-64446/ 2025-11-14T16:15:58+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2025-64446 9.8 true true

A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted…

https://threatroundup.com/cve/cve-2025-54236/ 2025-09-09T14:15:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2025-54236 9.1 true true

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this…

https://threatroundup.com/cve/cve-2024-40711/ 2024-09-07T17:15:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2024-40711 9.8 true true

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

https://threatroundup.com/cve/cve-2024-40766/ 2024-08-23T07:15:03+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2024-40766 9.8 true false

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices,…

https://threatroundup.com/cve/cve-2023-20269/ 2023-09-06T18:15:08+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2023-20269 9.1 true false

A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid…

https://threatroundup.com/cve/cve-2023-27532/ 2023-03-10T22:15:10+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2023-27532 7.5 true true

Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.

https://threatroundup.com/cve/cve-2021-4034/ 2022-01-28T20:15:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-4034 7.8 true true

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the…

https://threatroundup.com/cve/cve-2022-21894/ 2022-01-11T21:15:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2022-21894 4.4 false true

Secure Boot Security Feature Bypass Vulnerability

https://threatroundup.com/cve/cve-2021-44228/ 2021-12-10T10:15:09+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2021-44228 10 true true

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages…

https://threatroundup.com/cve/cve-2021-42287/ 2021-11-10T01:19:46+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-42287 7.5 true true

Active Directory Domain Services Elevation of Privilege Vulnerability

https://threatroundup.com/cve/cve-2021-42278/ 2021-11-10T01:19:44+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2021-42278 7.5 true true

Active Directory Domain Services Elevation of Privilege Vulnerability

https://threatroundup.com/cve/cve-2021-33045/ 2021-09-15T22:15:10+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2021-33045 9.8 true true

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

https://threatroundup.com/cve/cve-2021-33044/ 2021-09-15T22:15:10+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Critical 1 CVE-2021-33044 9.8 true true

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.

https://threatroundup.com/cve/cve-2020-3259/ 2020-05-06T17:15:12+00:00 ThreatRoundup.com NVD (National Vulnerability Database) High 1 CVE-2020-3259 7.5 true false

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the…

https://threatroundup.com/cve/cve-2019-6693/ 2019-11-21T16:15:13+00:00 ThreatRoundup.com NVD (National Vulnerability Database) Medium 1 CVE-2019-6693 6.5 true true

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacker with access to the backup file to decipher the sensitive data, via knowledge of the hard-coded key. The aforementioned sensitive data…