Vulnerability feed

CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run Oct 26 04:05 UTC

Critical in the last 24 hours

1602 in 30 days

Newly known exploited

In the last 24 hours, CISA KEV and vendor reports

Sources checked

Every hour, see the list

New in the last 24 hours

154-74% vs 7-day avg of 597

2 critical, 44 high, 61 medium, 27 low

17280 advisories Export 325 shown as CSV

Expand	Severity	Score	Advisory	Title	Source	Published
	High	7.8	RHSA-2026:89747	xorg-x11-server security update Red Hat, x.orgRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, x.org xorg-x11-server	Red Hat Security Advisories	Oct 26 03:59 UTC
RHSA-2026:89747CVE-2026-88812CVE-2026-93516CVE-2026-93517CVE-2026-935183 morexorg-x11-server security update Executive summary Red Hat has released an update for xorg-x11-server, the X Window System server, on Red Hat Enterprise Linux 8. The advisory rates the update as Important and describes multiple flaws that could allow arbitrary code execution or privilege escalation. Technical summary The advisory lists eight CVEs (CVE-2026-93516, CVE-2026-93521, CVE-2026-88812, CVE-2026-93523, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520) covering use-after-free, double-free, heap and buffer overflows, out-of-bounds writes, integer truncation, and privilege escalation via crafted RandR requests. Attack vector, required privileges, and user interaction are not stated in the advisory text. Affected package versions and fixed versions are not stated in the text provided. No workarounds or detection guidance are stated. CVSS base scores are referenced via the CVE pages but are not given in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Red Hat x.org Red Hat Enterprise Linux Red Hat Enterprise Linux 8 x.org xorg-x11-server Red Hat Product SecurityPublished Oct 26, 2026 03:59 UTC Read the advisory
	High	7.5	RHSA-2026:89754	freeipmi security, bug fix, and enhancement update Red Hat, FreeIPMIRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat CodeReady Linux Builder, FreeIPMI, Red Hat freeipmi	Red Hat Security Advisories	Oct 26 03:39 UTC
RHSA-2026:89754CVE-2026-85504CVE-2026-85505CVE-2026-85506CVE-2026-855071 morefreeipmi security, bug fix, and enhancement update Executive summary Red Hat has released a security update for the freeipmi package on Red Hat Enterprise Linux 8, which provides tools for managing servers through the Intelligent Platform Management Interface. The advisory rates the update as Moderate severity and fixes six vulnerabilities that can lead to arbitrary code execution or denial of service. The vendor recommends applying the updated freeipmi packages as described in its linked guidance. Technical summary The advisory describes stack-based buffer overflows and buffer over-reads in freeipmi, including in the ipmi-oem component, and one flaw triggered by malformed Fujitsu System Event Log responses. The impact listed includes arbitrary code execution for most issues and denial of service for CVE-2026-85505. Affected packages are freeipmi versions before 1.6.20-1.el8_10, and the fixed version is freeipmi-1.6.20-1.el8_10 across the listed RHEL 8 and CodeReady Linux Builder channels. The advisory does not state attack vector, required preconditions, or any workaround. It does not state whether exploitation in the wild has occurred, and it does not give a CVSS score in the text, referring readers to the CVE pages instead. Detection guidance is not stated beyond the update instructions at the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89754 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat FreeIPMI Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat CodeReady Linux Builder FreeIPMI Red Hat freeipmi Red Hat Product SecurityPublished Oct 26, 2026 03:39 UTC Read the advisory
	High	7.7	RHSA-2026:89739	openssh security update Red HatRed Hat Enterprise Linux	Red Hat Security Advisories	Oct 26 03:26 UTC
RHSA-2026:89739CVE-2026-55653CVE-2026-55655CVE-2026-59995CVE-2026-599961 moreopenssh security update Executive summary Red Hat has released an openssh security update for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat rates the update as Important and says it fixes six security issues in the OpenSSH client and server. Technical summary The fixes cover several classes of flaw: a local man-in-the-middle of X11 forwarding via abstract UNIX socket pre-binding in the OpenSSH client, a double free in the DH-GEX client path during FIPS known-group validation that causes client-side denial of service, a sftp client issue that lets an attacker control the downloaded file location, a use-after-free during client-side host key re-exchange, a sshd security bypass from incorrect handling of forwarding and tunneling options, and an scp file misplacement during remote copy. The advisory does not state affected or fixed package versions, attack preconditions beyond what the titles imply, workarounds, or detection guidance. CVSS scores are referenced via the CVE pages but are not given in this text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenBSD OpenSSH Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L Affects Red Hat Red Hat Enterprise Linux Red Hat Product SecurityPublished Oct 26, 2026 03:26 UTC Read the advisory
	Medium	5.5	CVE-2026-116112	A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d HashenUdaraHashenUdara edoc-doctor-appointment-system	NVD	Oct 26 03:17 UTC
CVE-2026-116112A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up to cc258425b915d1af9e298777ccd26d160493e68d Executive summary The advisory says the edoc doctor appointment system, a PHP and MySQL web application, has an unauthenticated SQL injection flaw in its admin add-new endpoint. An outside attacker could read database contents and create arbitrary doctor accounts without logging in. The advisory does not state a severity score, and it does not state a fixed version or a vendor recommendation beyond general remediation advice in the write-up. Technical summary The flaw is an unauthenticated time-based blind SQL injection in POST /admin/add-new.php, via the spec parameter, which is concatenated unquoted into an INSERT statement. The endpoint lacks effective authentication because header() redirects do not terminate script execution, so the SQL runs regardless of session state. The advisory describes the same pattern in 60+ other handlers. It notes that stacked queries are not possible through mysqli::query(), so UPDATE and DELETE are not reachable, and that the webuser INSERT hardcodes usertype 'd'. The affected version is given as commit cc258425b915d1af9e298777ccd26d160493e68d, and the advisory states that the affected version range is up to that commit. A fixed version is not stated. A workaround is not stated beyond the remediation advice to add exit after redirects and use prepared statements. Detection guidance such as log signatures or WAF rules is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/asdfghjkl12345678910111…2441cca911ecbfaa9acb Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HashenUdara HashenUdara edoc-doctor-appointment-system NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Low	2.1	CVE-2026-116111	A vulnerability was determined in 2K Games Civilization V 1.0.3.144 2K Games2K Games Civilization V	NVD	Oct 26 03:17 UTC
CVE-2026-116111A vulnerability was determined in 2K Games Civilization V 1.0.3.144 Executive summary A proof-of-concept exploit script has been published for 2K Games Civilization V version 1.0.3.144. The advisory text provided describes a Lua bytecode exploit that would run a command on the host, and it does not state how serious the flaw is by any official rating or what the vendor recommends. Technical summary The advisory is a copied Lua exploit script (exploit.lua) that manipulates string.dump bytecode to gain control of the instruction pointer and then calls os.execute with a command (calc.exe in the sample), which suggests a memory corruption class of flaw. The advisory does not describe the attack vector, whether authentication or user interaction is required, or the precondition that a user must load or run a crafted Lua payload. Affected versions are stated only as 1.0.3.144, and no fixed version, workaround, CVSS score, or detection guidance is stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/drbloop2000/Sid-Meier-s-Civi…lob/main/exploit.lua Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects 2K Games 2K Games Civilization V NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116110	A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows GiantappManGiantappMan LiveWallPaper	NVD	Oct 26 03:17 UTC
CVE-2026-116110A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows Executive summary A vulnerability was reported in GiantappMan LiveWallPaper version 2.6.8.0 on Windows, a desktop wallpaper application. The advisory text does not describe the flaw's type or how serious it is, and it does not give a vendor recommendation. Defenders should check whether this application is installed and watch for a vendor fix or further details. Technical summary The advisory states only that a vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. The vulnerability class, attack vector, and required preconditions are not stated. No fixed version is stated, and no workaround is stated. No CVSS score, exploitation status, or detection guidance is stated. The rest of the text is repository page content, including branch names such as v3.x, which is not identified as affected or fixed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/GiantappMan/livewallpaper Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GiantappMan GiantappMan LiveWallPaper NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	Low	2.1	CVE-2026-116109	A vulnerability has been found in continuedev Continue 2.0.0 continuedevcontinuedev continue	NVD	Oct 26 03:17 UTC
CVE-2026-116109A vulnerability has been found in continuedev Continue 2.0.0 Executive summary A vulnerability has been found in Continue 2.0.0, an AI coding assistant made by continuedev. The advisory says it allows operating system command injection that can be triggered remotely, and that exploit details are public. The advisory does not state a severity score, and the vendor did not respond to early disclosure contact. Technical summary The flaw is an OS command injection in the function MCPManagerSingleton.setConnections in core/config/ConfigHandler.ts, within the MCP Server Transport component. The advisory says the attack can be executed remotely, but it does not describe the required preconditions or user interaction. The advisory states that the exploit has been disclosed and may be used. No fixed version, workaround, CVSS score, or detection guidance is stated, and the vendor did not respond to early disclosure contact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects continuedev continuedev continue NIST National Vulnerability DatabasePublished Oct 26, 2026 03:17 UTC Read the advisory
	High	7.5	RHSA-2026:89738	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL, Red Hat compat-openssl11	Red Hat Security Advisories	Oct 26 02:36 UTC
RHSA-2026:89738CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published security update RHSA-2026:89738 for the compat-openssl11 package on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. Red Hat rates the update as Important and describes two vulnerabilities in the OpenSSL compatibility libraries, one a heap buffer overflow and one a DTLS handshake issue. Red Hat recommends installing the updated compat-openssl11 packages. Technical summary The advisory lists two flaws: CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS issue where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state attack vectors, preconditions, or CVSS scores, and it refers readers to the CVE pages for those details. Fixed package version is compat-openssl11-1.1.1k-5.el9_6.4 as listed in the package tables. No workarounds or detection guidance are stated, and no exploitation in the wild is mentioned. Update instructions point to https://access.redhat.com/articles/11258. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89738 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL Red Hat compat-openssl11 Red Hat Product SecurityPublished Oct 26, 2026 02:36 UTC Read the advisory
	High	7.5	RHSA-2026:89741	rhc security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10, Red Hat rhc	Red Hat Security Advisories	Oct 26 02:35 UTC
RHSA-2026:89741CVE-2026-111943CVE-2026-78667CVE-2026-78669CVE-2026-97031rhc security update Executive summary Red Hat has released a security update for the rhc client tool on Red Hat Enterprise Linux 8, rated Important by the publisher. The flaws are denial-of-service and man-in-the-middle issues in the Go components that rhc is built with, and Red Hat recommends applying the update described in its advisory. Technical summary The advisory lists four CVEs in Go standard library components: CVE-2026-78667 (denial of service via crafted HTTP Range headers), CVE-2026-97031 (denial of service via multiple ECH outer extension references in crypto/tls), CVE-2026-78669 (denial of service via excessive HTTP/2 SETTINGS frames), and CVE-2026-111943 (man-in-the-middle via untrusted intermediate certificates in crypto/x509). The fixed package is rhc-0.2.5-13.el8_10 for the listed RHEL 8 and RHEL 8.10 Extended Life Cycle architectures. Attack vector and preconditions beyond the descriptions are not stated, and no CVSS scores are given in the text (they are referenced via CVE pages not included here). No workarounds or detection guidance are stated; the advisory points to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Go Go standard library Summarized from access.redhat.com/errata/RHSA-2026:89741 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 Red Hat rhc Red Hat Product SecurityPublished Oct 26, 2026 02:35 UTC Read the advisory
	Low	2.1	CVE-2026-116108	A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0 openbq-orgopenbq-org OpenBB	NVD	Oct 26 02:17 UTC
CVE-2026-116108A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0 Executive summary A flaw has been found in OpenBB, an investment research platform from openbq-org, affecting versions up to 4.7.2 and 5.0.0. The advisory says a public exploit has been published and may be used, and it notes the vendor did not respond to early disclosure. The advisory does not state a severity score or a fix. Technical summary The weakness is classified as improper access controls in the Local API Server component, specifically in the file openbb_platform/core/openbb_core/app/model/api_settings.py. The advisory states remote exploitation is possible and that a published exploit may be used. Affected versions are stated as up to 4.7.2/5.0.0, and no fixed version is stated. No workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor did not respond to early disclosure, so no vendor patch or guidance is referenced. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openbq-org openbq-org OpenBB NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Low	2.1	CVE-2026-116107	A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress DatafeedrDatafeedr Product Sets Plugin	NVD	Oct 26 02:17 UTC
CVE-2026-116107A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress Executive summary A flaw in the Datafeedr Product Sets Plugin for WordPress, in versions up to 1.3.24, lets someone perform an action they should not be allowed to perform. The advisory says a public exploit exists and recommends upgrading to version 1.3.25. Technical summary The weakness is missing authorization in the dfrps_ajax_delete_saved_search function in functions/ajax.php, part of the AJAX Handlers component. The advisory says the attack may be launched remotely and that an exploit is public. It does not state what privileges or user interaction are required, what impact beyond the missing check is possible, or any CVSS score. Affected versions are up to and including 1.3.24, and the fixed version is 1.3.25. The advisory does not state any workaround or detection guidance. It states the vendor was contacted early about the disclosure. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Datafeedr Datafeedr Product Sets Plugin NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116106	A security vulnerability has been detected in HeyCyan App 1.0.103 on Android HeyCyanHeyCyan App	NVD	Oct 26 02:17 UTC
CVE-2026-116106A security vulnerability has been detected in HeyCyan App 1.0.103 on Android Executive summary A security flaw has been reported in the HeyCyan App version 1.0.103 on Android. The flaw involves improper access controls in a file-sharing component, and it can reportedly be triggered remotely. The vendor was contacted before disclosure but did not respond. Technical summary The advisory describes an improper access control weakness in the FileProvider component of HeyCyan App 1.0.103 on Android, with the specific functionality left unspecified. The attack may be initiated remotely. Severity score, CVSS vector, and exploitation status are not stated. Preconditions beyond remote initiation are not stated. Affected versions beyond 1.0.103 are not stated. A fixed version is not stated, and the vendor did not respond to disclosure. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HeyCyan HeyCyan App NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	Medium	6.3	CVE-2026-116105	A weakness has been identified in HeyCyan App 1.0.103 on Android HeyCyanHeyCyan App	NVD	Oct 26 02:17 UTC
CVE-2026-116105A weakness has been identified in HeyCyan App 1.0.103 on Android Executive summary A weakness has been identified in the HeyCyan App version 1.0.103 for Android, which could allow sensitive information to be sent over the network without encryption. The advisory describes the attack as difficult to carry out, and the vendor did not respond to early disclosure contact. No vendor fix or recommended action is stated in the advisory. Technical summary The weakness is in the Network Security Configuration component, specifically the AndroidManifest.xml file, and results in cleartext transmission of sensitive information (CWE class cleartext transmission). The attack can be launched remotely but the advisory says it requires high complexity and is difficult to exploit. The advisory does not state any fixed version, workaround, or detection guidance. The vendor was contacted early but did not respond, so no vendor patch or statement is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HeyCyan HeyCyan App NIST National Vulnerability DatabasePublished Oct 26, 2026 02:17 UTC Read the advisory
	High	8.8	RHSA-2026:89733	flatpak security update Red Hat, flatpakRed Hat Enterprise Linux, flatpak, Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server - AUS 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6, Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6, Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6, Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6, Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6, Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6	Red Hat Security Advisories	Oct 26 02:12 UTC
RHSA-2026:89733CVE-2026-90616CVE-2026-96275CVE-2026-96280CVE-2026-96808flatpak security update Executive summary Red Hat published advisory RHSA-2026:89733 for the flatpak package, which is used to build, distribute, and run sandboxed desktop applications on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. Red Hat rates the update Important and lists four security flaws that can lead to code execution or privilege escalation. Red Hat recommends applying the flatpak update described in the advisory. Technical summary The advisory lists four flaws in flatpak: missing symlink protection leading to arbitrary code execution (CVE-2026-90616), extra-data extraction giving arbitrary write access as root (CVE-2026-96275), a buffer overflow in OCI delta stream path names on 32-bit systems (CVE-2026-96280), and local privilege escalation via symlink traversal in the revokefs writer (CVE-2026-96808). The fixed package version is flatpak-1.12.9-4.el9_6.5, as written in the advisory. The advisory does not state CVSS scores in the text provided, attack preconditions beyond the descriptions above, workarounds, or exploitation in the wild, and it refers readers to the CVE pages and to https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89733 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat flatpak Red Hat Enterprise Linux flatpak Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server - AUS 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 Red Hat Product SecurityPublished Oct 26, 2026 02:12 UTC Read the advisory
	High	7.5	RHSA-2026:89736	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL, OpenSSL compat-openssl11	Red Hat Security Advisories	Oct 26 02:04 UTC
RHSA-2026:89736CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published an Important-rated security update for the compat-openssl11 package on Red Hat Enterprise Linux 9.4 systems, including Update Services for SAP Solutions, 4 years of updates, and Extended Life Cycle channels. The update fixes two OpenSSL flaws, one a heap buffer overflow in CMS key unwrapping and one a DTLS handshake retransmission issue. Red Hat recommends applying the updated packages, and the advisory points to its update instructions. Technical summary The advisory describes CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS issue where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state the attack vector, required preconditions, or CVSS scores, and points to the CVE pages for those details. The fixed package is compat-openssl11-1.1.1k-5.el9_4.4 across the listed RHEL 9.4 channels. The advisory does not state any workaround or mitigation, and it gives no detection guidance or information on exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89736 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL OpenSSL compat-openssl11 Red Hat Product SecurityPublished Oct 26, 2026 02:04 UTC Read the advisory
	High	7.5	RHSA-2026:89737	compat-openssl11 security update Red Hat, OpenSSLRed Hat Enterprise Linux, OpenSSL	Red Hat Security Advisories	Oct 26 01:58 UTC
RHSA-2026:89737CVE-2026-63072CVE-2026-84782compat-openssl11 security update Executive summary Red Hat published an Important security update for the compat-openssl11 package on Red Hat Enterprise Linux 9.2 systems, including Update Services for SAP Solutions, Extended Life Cycle, and related channels. The advisory fixes two OpenSSL flaws, a heap buffer overflow in CMS key unwrapping and a DTLS handshake retransmission issue, and Red Hat recommends applying the updated packages. The advisory does not state a CVSS score for either flaw in the text provided. Technical summary The advisory describes CVE-2026-63072, a heap buffer overflow in CMS key unwrapping, and CVE-2026-84782, a DTLS flaw where retransmitted handshake messages are taken from a stale buffer offset. The advisory does not state the attack vector, exploitation preconditions, or whether either flaw is exploited in the wild. The fixed package version is compat-openssl11-1.1.1k-4.el9_2.3, and the vulnerable prior versions are not stated. No workaround or detection guidance is stated, and the advisory directs readers to https://access.redhat.com/articles/11258 for how to apply the update. CVSS scores are referenced to the CVE pages and are not given in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89737 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat OpenSSL Red Hat Enterprise Linux OpenSSL Red Hat Product SecurityPublished Oct 26, 2026 01:58 UTC Read the advisory
	High	7.5	RHSA-2026:89734	jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Red Hat, FasterXMLRed Hat Enterprise Linux, FasterXML jackson-core, Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6, FasterXML jackson-databind, FasterXML jackson-jaxrs-providers, FasterXML jackson-modules-base	Red Hat Security Advisories	Oct 26 01:46 UTC
RHSA-2026:89734CVE-2026-68497CVE-2026-91777jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update Executive summary Red Hat advisory RHSA-2026:89734 fixes two denial-of-service flaws in the Jackson Java JSON libraries, shipped in Red Hat Enterprise Linux 9.6 Extended Update Support and related RHEL 9.6 subscriptions. Red Hat rates the update Important. Red Hat recommends applying the updated jackson packages listed in the advisory. Technical summary The advisory covers two denial-of-service flaws in jackson-databind: CVE-2026-68497, a CPU denial of service via unbounded numeric parsing, and CVE-2026-91777, a denial of service via quadratic forward-reference completion. The advisory does not state the attack vector, required privileges, or user interaction. Fixed package versions are listed as jackson-core-2.21.6-1.el9_6, jackson-databind-2.21.6-1.el9_6.1, jackson-jaxrs-providers-2.21.6-1.el9_6, and jackson-modules-base-2.21.6-1.el9_6, along with pki-jackson packages. No CVSS score is given in the text, and it refers to the CVE pages for details. No workarounds or detection guidance are stated. Administrators should apply the update using the article referenced in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:89734 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects Red Hat FasterXML Red Hat Enterprise Linux FasterXML jackson-core Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 FasterXML jackson-databind FasterXML jackson-jaxrs-providers FasterXML jackson-modules-base Red Hat Product SecurityPublished Oct 26, 2026 01:46 UTC Read the advisory
	High	7.5	RHSA-2026:89730	libX11 security update Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux for x86_64 8, Red Hat Enterprise Linux for IBM z Systems 8, Red Hat Enterprise Linux for Power, little endian 8, Red Hat Enterprise Linux for ARM 64 8, Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10, Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10, Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10	Red Hat Security Advisories	Oct 26 01:43 UTC
RHSA-2026:89730CVE-2026-88806libX11 security update Executive summary A security update for libX11, the core X11 client library, is available for Red Hat Enterprise Linux 8 systems. Red Hat rates the issue as Important and says it is a heap-based buffer overflow that can be triggered through a malicious X server. Red Hat recommends applying the updated libX11 packages, version 1.6.8-10.el8_10, as described in its update instructions. Technical summary The flaw is tracked as CVE-2026-88806 and is classified as a heap-based buffer overflow in libX11 triggered via a malicious X server. The advisory does not state the attack preconditions beyond a malicious X server, and it does not give a CVSS score in the text provided, referring instead to the CVE page. The fixed package version is libX11-1.6.8-10.el8_10 across the listed Red Hat Enterprise Linux 8 and Extended Life Cycle 8.10 architectures. The advisory does not state any workaround or mitigation, nor any detection guidance, and it does not state whether the issue is being exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: X.Org libX11 Summarized from access.redhat.com/errata/RHSA-2026:89730 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affects Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 Red Hat Enterprise Linux for IBM z Systems 8 Red Hat Enterprise Linux for Power, little endian 8 Red Hat Enterprise Linux for ARM 64 8 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 Red Hat Product SecurityPublished Oct 26, 2026 01:43 UTC Read the advisory
	Low	2.1	CVE-2026-116104	A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0 SonySony Neural Network Libraries, Sony NNabla	NVD	Oct 26 01:17 UTC
CVE-2026-116104A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0 Executive summary A code injection flaw affects Sony NNabla Neural Network Libraries up to version 1.39.0. Converting a malicious model file can run attacker-chosen commands on the machine doing the conversion, and the advisory rates it High with a CVSS v3.1 score of 8.8. The advisory states that the project is end of life and no upstream fix is expected, so it recommends not converting .nnp files from untrusted sources until a patched fork exists. Technical summary The flaw is CWE-94 code injection: the NNP converter passes the attacker-controlled function.type field into Python eval() calls in func_set_nnabla_version_decorate (utils.py lines 111 and 116). A duplicate network name lets a malicious second network bypass the version gate, which only checks the first same-name network. Exploitation requires the victim to run nnabla_cli convert on a crafted .nnp file (network attack vector, user interaction required, no privileges). The advisory states that the affected version is 1.39.0 and that the earliest affected version is unknown, and it gives no fixed version because the project is EOL. Recommended fixes are replacing eval() with getattr/hasattr, validating function.type against known types, and enforcing unique network names. The advisory does not state any detection guidance, and no vendor advisory is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/3em0/cve_repo/blob/main/2026…n-in-NNP-Converter-('function.type'-eval()).md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Sony Sony Neural Network Libraries Sony NNabla NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116103	A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 SonySony Neural Network Libraries, Sony Neural Network Libraries (nnabla)	NVD	Oct 26 01:17 UTC
CVE-2026-116103A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 Executive summary Sony Neural Network Libraries (nnabla) up to and including v1.39.0 contains a code injection flaw in its command-line parameter encoder. An attacker who supplies a malicious parameter directory can run arbitrary operating system commands when a victim runs the documented encode_param command, and the advisory says this happens without any visible error. The advisory rates the issue High under CVSS v3.1 with a score of 8.8, and states that the project is end-of-life so no upstream patch is expected, with the workaround being to avoid processing parameter directories from untrusted sources. Technical summary The flaw is CWE-95 eval injection: the first line of each .txt parameter file is passed to Python's eval() without validation in load_param_in_txt() in encode_decode_param.py at line 37, reachable through nnabla_cli encode_param. Exploitation requires the victim to run the command on an attacker-supplied directory (CVSS AV:N, PR:N, UI:R, AC:L), and the advisory's proof of concept shows the canary command completing with exit code 0. Affected versions are stated as all versions up to and including v1.39.0, and the advisory says vulnerable code remains on the master branch; no fixed version is stated because the project is end-of-life and no upstream patch is expected. The suggested remediation is to replace eval() with ast.literal_eval() plus integer validation, and the stated workaround is to never run encode_param or decode_param on untrusted directories. The advisory gives no detection guidance beyond the proof of concept, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/3em0/cve_repo/blob/main/2026…)-Code-Injection-in-'nnabla_cli%20encode_param'-Leading-to-Arbitrary-Command-Execution.md Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Sony Sony Neural Network Libraries Sony Neural Network Libraries (nnabla) NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116102	A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0 QuantGeekDevQuantGeekDev docker-mcp	NVD	Oct 26 01:17 UTC
CVE-2026-116102A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0 Executive summary A command injection flaw has been reported in the docker-mcp project by QuantGeekDev, affecting versions 0.1.0 and 0.2.0. The advisory says the flaw can be triggered remotely, and it does not state a severity score or a vendor recommendation. Technical summary The flaw is an OS command injection in the _build_windows_command function of docker_executor.py, triggered by manipulating the project_name argument. The advisory states the attack can be started remotely. Affected versions are listed as 0.1.0/0.2.0. Fixed versions are not stated. Workarounds are not stated. Exploitation in the wild is not stated. Detection guidance is not stated, and no CVSS score is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects QuantGeekDev QuantGeekDev docker-mcp NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116101	A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 itsourcecodeitsourcecode Online Cake Ordering System	NVD	Oct 26 01:17 UTC
CVE-2026-116101A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 Executive summary A SQL injection flaw has been reported in the Online Cake Ordering System version 1.0 from itsourcecode. An attacker could potentially read, change, or disrupt the application's database, and the advisory describes the risk as serious. The advisory recommends using prepared statements, validating user input, limiting database account permissions, and running regular security audits; it does not state a vendor-issued fix. Technical summary The flaw is an SQL injection in the id parameter of /deletetransac.php, which the advisory says fails to sanitize or validate input before it is used in SQL queries. The proof of concept is a GET request with a crafted id value that uses GTID_SUBSET error-based injection against the host 154.219.114.125:9012. The advisory is inconsistent about preconditions: the root cause text says the attacker must log in with valid credentials, while the POC section says no authentication is required and exploitation does not require prior access. Affected version is listed as V1.0. A fixed version is not stated, no CVSS score is stated, and exploitation in the wild is not stated. The suggested repairs are prepared statements, input validation, minimal database permissions, and security audits; no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/RyanCarter9527/submit/issues/1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects itsourcecode itsourcecode Online Cake Ordering System NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	1.9	CVE-2026-116100	A vulnerability has been found in gougucms up to 4.08.18 GouguCMSGouguCMS	NVD	Oct 26 01:17 UTC
CVE-2026-116100A vulnerability has been found in gougucms up to 4.08.18 Executive summary A stored cross-site scripting flaw has been reported in GouguCMS up to version 4.08.18, affecting its user level management feature. An administrator account can save malicious script as a user level name, which then runs in the browser of any administrator who views the list. The advisory does not state a severity rating or a vendor fix, so the recommended response is not stated. Technical summary This is a stored cross-site scripting (XSS) vulnerability in the user level function of GouguCMS v4.08.18, in app/admin/controller/Level.php and related files. An authenticated administrator can submit HTML or JavaScript in the title parameter, which is stored in cms_user_level.title without output encoding and rendered as HTML in the admin user-level list. The advisory provides a proof-of-concept POST request to /admin/level/add that sets the title to a script tag, and notes the same value also appears in the user list via /admin/user/index. The advisory does not state a fixed version, a workaround, a CVSS score, or whether exploitation has been observed in the wild. Detection guidance beyond the reproduction steps is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yuhuixiaowu/cve/blob/main/go…ucms_v4.08.18_XSS.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects GouguCMS GouguCMS NIST National Vulnerability DatabasePublished Oct 26, 2026 01:17 UTC Read the advisory
	Low	2.1	CVE-2026-116099	A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Fusion Creators StudioFusion Creators Studio SCP Containment Breach Multiplayer	NVD	Oct 26 00:17 UTC
CVE-2026-116099A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 Executive summary A flaw has been reported in Fusion Creators Studio SCP Containment Breach Multiplayer, affecting versions up to 1.295. The advisory text describes a buffer overflow that could allow remote code execution, and it links to a public exploit repository. The advisory does not state a severity rating, and no vendor fix or recommendation is provided in the text. Technical summary The advisory describes a buffer overflow vulnerability that allows arbitrary remote code execution. The stated preconditions are subscribing to a malicious addon on the workshop or connecting to a server that runs the RCE addon, and then playing the game. The affected version is stated as up to 1.295 in the title, and no fixed version is stated. No workaround, CVSS score, or vendor patch guidance is stated. Detection guidance is not stated, and the referenced repository includes a proof-of-concept exploit file named Exploit.gs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/drbloop2000/SCP-CBM-RCE/tree/main Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Fusion Creators Studio Fusion Creators Studio SCP Containment Breach Multiplayer NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116098	A vulnerability was detected in SteelRaven7 Ravenfield 25407073 SteelRaven7SteelRaven7 Ravenfield	NVD	Oct 26 00:17 UTC
CVE-2026-116098A vulnerability was detected in SteelRaven7 Ravenfield 25407073 Executive summary The advisory reports a vulnerability in SteelRaven7 Ravenfield, but the text provided is a Steam Community web page and contains no description of the flaw itself. The severity and vendor recommendations are not stated. Technical summary The advisory text only says a vulnerability was detected in SteelRaven7 Ravenfield 25407073, followed by boilerplate Steam Community page content. The vulnerability class, attack vector, and preconditions are not stated. Affected and fixed versions are not stated beyond the version string 25407073 shown in the title. No workaround, detection guidance, CVSS score, or evidence of exploitation is stated. Defenders should consult the NVD entry and the vendor for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from steamcommunity.com/app/636480/events/590690402783479125 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SteelRaven7 SteelRaven7 Ravenfield NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	2.1	CVE-2026-116097	A security vulnerability has been detected in CloudClassroom-PHP-Project CloudClassroom-PHP-ProjectCloudClassroom-PHP-Project, CloudClassroom-PHP-Project addnewstudent.php	NVD	Oct 26 00:17 UTC
CVE-2026-116097A security vulnerability has been detected in CloudClassroom-PHP-Project Executive summary A stored cross-site scripting flaw affects CloudClassroom-PHP-Project version 1.0 and prior, in the addnewstudent.php and studentdetails.php components. The advisory rates it Medium with a CVSS score of 6.1 and says the product is unpatched with no fix available yet. The advisory's recommended mitigations are output encoding, input validation, restricting access to the affected component, and reviewing sessions and credentials. Technical summary The flaw is stored (persistent) cross-site scripting (CWE-79) in addnewstudent.php, where the fname, lname, faname, addrs and course fields are saved without sanitization and echoed back without HTML encoding, and the name is rendered unencoded in studentdetails.php. The advisory states that no authentication is needed to inject the data, that a victim admin or faculty user must view the record (user interaction required), and that the attack is remote over the network via POST. Affected versions are listed as 1.0 (and prior), and the fixed version is listed as None. The advisory gives workarounds: htmlspecialchars encoding with ENT_QUOTES, input validation, Content-Security-Policy, prepared statements, network ACLs and WAF rules, and session invalidation. It provides log search indicators for suspicious values such as script, onerror, onload and svg tags. It does not state a CVE identifier, an official vendor response, or any evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vinniboy021-blip/Advisory/bl…tudent-stored-xss.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects CloudClassroom-PHP-Project CloudClassroom-PHP-Project CloudClassroom-PHP-Project addnewstudent.php NIST National Vulnerability DatabasePublished Oct 26, 2026 00:17 UTC Read the advisory
	Low	1.9	CVE-2026-116096	A weakness has been identified in ggml-org llama.cpp ggml-orgggml-org llama.cpp	NVD	Oct 25 23:17 UTC
CVE-2026-116096A weakness has been identified in ggml-org llama.cpp Executive summary The advisory describes a weakness in ggml-org llama.cpp, a C/C++ library for running large language models. The text provided is mostly repository content and does not describe the weakness, its severity, or a vendor fix, so these points are not stated. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It does not list affected or fixed versions, workarounds, CVSS score, or exploitation status. The only identifiable reference is to the llama.cpp master branch repository page, which is not a version statement. Defenders should consult the NVD entry at the provided URL or the upstream project's security policy for the specific details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ggml-org/llama.cpp Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ggml-org ggml-org llama.cpp NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116095	A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 smg-projectsmg-project smg	NVD	Oct 25 23:17 UTC
CVE-2026-116095A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1 Executive summary The advisory describes a flaw in smg-project smg versions 1.7.0 through 1.10.1 that appears to involve a crafted JPEG image causing excessive memory allocation. The advisory text is mostly a copied GitHub gist page and does not state a severity rating or a fixed version. No vendor recommendation is stated in the text provided. Technical summary The advisory text is a copied gist page containing a proof-of-concept Python script that writes JPEG files declaring dimensions of 65500x65500 and 20000x20000, which the script says would require a large byte allocation in a decoder, and PNG control files. The vulnerability class is not explicitly stated, though the script comments suggest resource exhaustion through image dimension handling. The attack vector and preconditions are implied to be supplying a crafted image to the affected software, but this is not explicitly stated. Affected versions are listed as 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1, and fixed versions, workarounds, CVSS score, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Yunzez/24a1bf4c226fbc324ea8da1d202c6d9b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects smg-project smg-project smg NIST National Vulnerability DatabasePublished Oct 25, 2026 23:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116094	A vulnerability was determined in EyouCMS up to 1.8.3 EyouCMSEyouCMS	NVD	Oct 25 22:16 UTC
CVE-2026-116094A vulnerability was determined in EyouCMS up to 1.8.3 Executive summary A vulnerability was reported in EyouCMS up to version 1.8.3, a content management system. The advisory describes a server-side request forgery flaw that can be triggered from the public site, but it does not state a severity rating. Technical summary The advisory describes server-side request forgery caused by a missing SSRF check in the remote_file_to_local() function, which can be reached from the front end. It states the affected range as up to 1.8.3, but no fixed version is stated. Attack preconditions, CVSS score, and exploitation in the wild are not stated. No workaround is stated. No detection guidance is stated; the text mainly consists of repository file listings and references to a reproduction document and vulnerability report that are not included here. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yy-t1/security-reports/tree/…9%8D%E5%8F%B0%20SSRF Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects EyouCMS EyouCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115635	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115635Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert. When Ash.bulk_create/4 or a single... Executive summary A flaw in AshPostgres, a database library used with the Ash framework, can let one tenant read another tenant's record in a multi-tenant application. The advisory rates it MEDIUM with a CVSS 4.0 base score of 6.0. The advisory points to a fix in version 2.15.2 and the fix commit 8aa8122, and it does not state any workaround. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the ash_postgres data layer. When an upsert is skipped during Ash.bulk_create/4 or a single create with return_skipped_upsert?: true, the lookup of the existing row did not apply attribute multitenancy, so a user could receive another tenant's record that shares the same identity values. The advisory says the affected range is from 2.6.22 before 2.15.2 on Hex, and from commit af0903f up to commit 8aa8122 on GitHub. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, which requires low privileges and a resource that uses attribute multitenancy with return_skipped_upsert?: true. The advisory does not state any workaround or in-the-wild exploitation, and it gives no specific detection guidance beyond the affected routines. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-115635.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115627	Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... ash-projectash-project ash_postgres	NVD	Oct 25 20:16 UTC
CVE-2026-115627Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join... Executive summary A flaw in the ash_postgres library, used with the Elixir Ash framework, lets a user in one tenant see records that belong to other tenants' data when certain relationships are loaded. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The advisory states the affected range is from 0.38.0 before 2.15.2 on Hex, and the fix is in commit 8c25c94 on GitHub; it does not explicitly state an upgrade recommendation beyond that fix. Technical summary This is an Incorrect Authorization flaw (CWE-863) where AshPostgres builds lateral join queries for many_to_many and through relationships without running the resource's read action, so attribute multitenancy is not applied to the join resource. The attack requires an authenticated user with low privileges (PR:L) and network access, and the preconditions are that the join resource uses :attribute multitenancy with rows from several tenants and that the relationship is loaded with a lateral join, such as with a limit, offset or sort. The advisory states the affected Hex versions as 0.38.0 up to but not including 2.15.2, and the GitHub affected range as commit 7115bec up to but not including 8c25c94. A workaround is not stated in the advisory. Detection guidance is not stated beyond the affected function names lateral_join_query/3, through_step_queries/4 and run_query_with_lateral_join/4 in lib/data_layer.ex. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-115627.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash_postgres NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Medium	6.0	CVE-2026-114214	Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... ash-projectash-project ash	NVD	Oct 25 20:16 UTC
CVE-2026-114214Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship. When a... Executive summary A flaw in the Ash framework, an Elixir library from ash-project, lets a client read destination records that should only be reachable through a specific relationship. The advisory rates it MEDIUM with a CVSS 4.0 score of 6.0. The vendor's fix is in version 3.37.1, and the advisory says affected versions are 3.24.0 before 3.37.1. Technical summary This is an Incorrect Authorization flaw (CWE-863) in the Ash read relationships code, specifically lateral_join?/4 in lib/ash/actions/read/relationships.ex. When a has_many through relationship is loaded for a single record with a limit of 1, or an unsorted has_one through relationship is loaded with a limit of 1, the query omits the filter linking destination records to the source, so the load returns unrelated records; paging with an offset can enumerate more of them. The attack vector is network with low complexity, and the CVSS vector requires low privileges and no user interaction, with high confidentiality impact. The advisory states the affected range as 3.24.0 up to but not including 3.37.1, with fix commit e374633, and says the vulnerable Git range is 24f41e2 to e374633. The advisory does not state a workaround or any detection guidance, and does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from cna.erlef.org/cves/CVE-2026-114214.html Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ash-project ash-project ash NIST National Vulnerability DatabasePublished Oct 25, 2026 20:16 UTC Read the advisory
	Low	2.0	CVE-2026-116063	A weakness has been identified in DedeCMS up to 5.7.118 DedeCMSDedeCMS	NVD	Oct 25 18:16 UTC
CVE-2026-116063A weakness has been identified in DedeCMS up to 5.7.118 Executive summary A remote code execution weakness has been reported in DedeCMS up to version 5.7.118, a content management system. The advisory rates it 7.2 under CVSS v3.1 base and 8.8 for the other listed score, and it lists a code injection flaw in the update guide script. Technical summary The advisory describes a code injection flaw in dede/update_guide.php that can lead to remote code execution, mapped to CWE-94, CWE-96, and CWE-352. The table lists CVSS v3.1 scores of 7.2 / 8.8 without stating which score is the base score, and it does not state the attack vector, required privileges, or user interaction in plain terms. The advisory does not state a fixed version, a workaround, or any detection guidance. It also does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/SDshadow/cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects DedeCMS DedeCMS NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116062	A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116062A security flaw has been discovered in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker can exploit it without logging in to read, change, or delete database data. The advisory does not state a severity rating, a fixed version, or a vendor patch. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/save_profile.php, where user input is placed directly into SQL queries without validation. The advisory describes it as time-based blind and says no login or authorization is required. The affected version is listed as V1.0, and no fixed version is stated. No workaround is stated beyond the suggested repair of using prepared statements with parameter binding, strict input validation, least-privilege database accounts, and regular audits. The advisory gives no detection guidance, no CVSS score, and does not say whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/13 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116061	A vulnerability was identified in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 18:16 UTC
CVE-2026-116061A vulnerability was identified in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents. The advisory does not state a vendor fix or official severity score, and it recommends using prepared statements, input validation, least-privilege database accounts, and regular security audits. Technical summary The flaw is SQL injection in the 'contact' parameter of /opils/staff/edit_dealer.php, which the advisory says is passed directly into SQL queries without validation. The advisory describes it as time-based blind injection, reproduced with sqlmap, and says no login or authorization is required. The affected version is listed as V1.0; a fixed version is not stated. No workaround beyond the suggested code fixes (prepared statements, input validation, minimal database permissions) is given, and no CVSS score or detection guidance is stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/12 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116060	A vulnerability was determined in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 17:17 UTC
CVE-2026-116060A vulnerability was determined in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw has been reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi application. The advisory says an attacker who needs no login could read, change, or delete database data and potentially disrupt the service. The advisory does not state a severity score or a vendor fix, and it recommends prepared statements, input validation, and least-privilege database accounts. Technical summary The flaw is a SQL injection in the 'contact' parameter of /opils/staff/adddealer.php, reached through a multipart/form-data POST request. The advisory states no login or authorization is required, and it describes a time-based blind variant that was confirmed with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor patch, workaround beyond the suggested code fixes, CVSS score, or exploitation in the wild is stated. The suggested repair is to use prepared statements with parameter binding, validate and filter input, restrict database account privileges, and run regular security audits. The advisory gives no specific detection guidance such as log signatures. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/11 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115825	HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... HTTP::Server::PSGIHTTP::Server::PSGI	NVD	Oct 25 17:17 UTC
CVE-2026-115825HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. The request body is read with sysread()... Executive summary HTTP::Server::PSGI for Perl, in versions before 1.0056, can be crashed by a single request that declares a very large Content-Length. The advisory describes the impact as the server dying with an out-of-memory error on Linux. The advisory points to a code change that caps body reads at 64 KiB, and the fixed release is named as the version that includes that change. Technical summary The flaw is a resource exhaustion issue: the request body was read with sysread() using the full remaining Content-Length, so Perl tried to grow the buffer to that size before reading and failed with "Out of memory!" on Linux. The attack vector is a single crafted HTTP request sent to the server, with no authentication stated as required. The advisory says versions before 1.0056 are affected and the patch caps reads at 64 KiB (CVE-2026-115825 is referenced in the commit), but a specific fixed version number beyond the 1.0056 threshold is not stated. Workarounds are not stated, and no detection guidance is given. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/plack/Plack/commit/11545871c…9cfeb4ebc1069a.patch Score No CVSS score published. Affects HTTP::Server::PSGI HTTP::Server::PSGI NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115824	Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115824Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The chunked body decoder keeps each chunk in memory until... Executive summary Starman, a Perl web server, has a flaw that lets an attacker exhaust server memory by sending chunked request bodies that the server keeps buffering without limit. The advisory does not state a severity rating or CVSS score. The fix is included in version 0.4019, and the advisory indicates the patch is available in the repository. Technical summary The advisory describes unbounded buffering of chunked request bodies in the chunk decoder, which can cause memory exhaustion, and the commit message also describes a quadratic-backtracking regex in chunk-size line parsing (CVE-2026-115822) that consumes CPU. The attack requires sending crafted chunked HTTP requests to a Starman server; the advisory does not state authentication or other preconditions. Affected versions are stated as those before 0.4019, and the fixed version is 0.4019. The fix replaces the regex with index() and an anchored parser, limits chunk-size lines to 4096 bytes, rejects sizes over 13 hex digits with 400 and closes the connection, and makes _prepare_env return an error status so bad bodies are not dispatched. No workarounds are stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/0f33…71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115823	Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115823Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked... Executive summary Starman, a Perl web server, sends response bodies for HEAD requests and for 1xx, 204 and 304 responses, which can cause response desynchronization on keep-alive connections. The advisory does not state a severity rating or an exploitation status, and the fix is in Starman versions 0.4019 and later. Technical summary The flaw is a response desynchronization issue (HTTP response smuggling class) in Starman before 0.4019 for Perl, where bodies are written for HEAD, 1xx, 204 and 304 responses even though those responses must not carry a body. On keep-alive or pipelined connections, the extra bytes are read as the start of the next response, and a front end that pools upstream connections can be affected. The advisory does not state a CVSS score, attack preconditions beyond keep-alive or pipelined connections, or a workaround. The fix is in commit 91c47c529cd1e100f938486896ea9083ec3ec7bf, which skips body output for these responses and closes object bodies without reading them, and it adds a test file t/no_body_response.t. Detection guidance is not stated, and the advisory names no specific fixed release beyond the version threshold of 0.4019. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/91c4…ea9083ec3ec7bf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115822	Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115822Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Starman decodes chunked request bodies... Executive summary The advisory says Starman, a Perl web server, is affected by a flaw that lets a remote sender exhaust CPU on the server by sending chunked request bodies with long runs of hex digits. The advisory does not give a severity rating or CVSS score. The vendor-side fix is a code change that rejects malformed or overly long chunk-size lines with a 400 error, and the advisory says versions before 0.4019 are affected. Technical summary The flaw is a regular expression backtracking problem (quadratic complexity, a form of algorithmic CPU exhaustion) in parsing the chunk-size line of chunked request bodies, which the commit message says ran again over the whole buffer after every read. The attacker needs only to send an HTTP request with Transfer-Encoding: chunked; the advisory says 32 KiB of input cost about 1.7 seconds of worker CPU. The fix bounds chunk-size lines to 4096 bytes, parses them with an anchored linear-time pattern, rejects sizes with more than 13 significant hex digits, and returns 400 and closes the connection on malformed input. The advisory states affected versions as before 0.4019, but it does not state a fixed version number explicitly, and no workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/0f33…71988e22476acf.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-115817	Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... StarmanStarman	NVD	Oct 25 17:17 UTC
CVE-2026-115817Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. Content-Length and chunked request... Executive summary Starman, a Perl web server, has a flaw where a client that sends a request body and then stalls can keep a server worker busy indefinitely, which can exhaust workers with only a few connections. The advisory describes the severity only in terms of workers being taken; a CVSS score is not stated. The fix adds a total time limit for reading request bodies, and the advisory's guidance is to update Starman to a release at or after 0.4019 (the fixed version is stated as 0.4019 in the advisory's wording of affected versions before 0.4019). Technical summary The weakness is a resource exhaustion issue (missing timeout on request body reads): read_timeout applied only to request headers, so a Content-Length or chunked body could stall or trickle indefinitely. The attack requires only network access to the Starman listener and a few open connections to tie up workers, and no authentication is mentioned. Affected versions are stated as before 0.4019 and the fix adds a --body-timeout option (body_timeout, default 300 seconds, 0 disables) that responds with 408 Request Timeout and closes the connection. The advisory does not state a CVSS score, a CWE, exploitation in the wild, or detection guidance beyond the timeout behavior, and it recommends a reverse proxy that buffers request bodies as a mitigation. Workaround details beyond setting body_timeout are not otherwise stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/miyagawa/Starman/commit/89df…15586ba2588558.patch Score No CVSS score published. Affects Starman Starman NIST National Vulnerability DatabasePublished Oct 25, 2026 17:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116058	A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 AlfrescoAlfresco Activiti	NVD	Oct 25 16:16 UTC
CVE-2026-116058A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692 Executive summary A vulnerability has been reported in Alfresco Activiti, a workflow product, affecting versions up to 7.21.0-rc.692. The advisory says it can be exploited remotely to inject code, and the vendor did not respond when contacted about it. The advisory does not state a severity score or a fix. Technical summary The flaw is described as code injection in the JuelScriptEngine.eval function of JuelScriptEngine.java, which is reached by performing a manipulation that the advisory does not specify. The attack can be initiated remotely. The advisory does not state any required privileges or user interaction, and it does not state a CVSS score. The advisory affects versions up to and including 7.21.0-rc.692, and no fixed version is stated. No workaround or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Alfresco Alfresco Activiti NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116057	A vulnerability has been found in KodCloud KodExplorer up to 4.55 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116057A vulnerability has been found in KodCloud KodExplorer up to 4.55 Executive summary KodCloud KodExplorer, a web-based file manager, is affected by a vulnerability in versions up to 4.55. The advisory says the flaw can be exploited remotely and that exploit details are public, but it does not state a severity score. The advisory does not state any vendor-recommended fix, and the vendor did not respond to early disclosure. Technical summary The flaw is an unrestricted upload issue in the Online Editor Save Endpoint, located in app/controller/editor.class.php, where manipulation of the path/filestr argument is reported. It can be attacked remotely, and the advisory says an exploit has been publicly disclosed and may be used. Affected versions are stated only as up to 4.55, and no fixed version is stated. No workaround, detection guidance, CVSS score, or authentication requirement is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116056	A flaw has been found in KodCloud KodExplorer up to 4.56 KodCloudKodCloud KodExplorer	NVD	Oct 25 16:16 UTC
CVE-2026-116056A flaw has been found in KodCloud KodExplorer up to 4.56 Executive summary A flaw has been found in KodCloud KodExplorer, a file management product, up to version 4.56. The advisory describes it as a server-side request forgery issue that can be triggered remotely. The vendor did not respond when contacted about the disclosure, and no fix or vendor recommendation is stated. Technical summary The flaw is server-side request forgery in the request_url_safe function of app/function/web.function.php, within the Remote Download component. An attacker can trigger it remotely by manipulating input to that function. The advisory states affected versions as up to 4.56 but does not state any fixed version. No workaround, exploitation status, CVSS score, or detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects KodCloud KodCloud KodExplorer NIST National Vulnerability DatabasePublished Oct 25, 2026 16:16 UTC Read the advisory
	Low	2.1	CVE-2026-116055	A vulnerability was detected in SourceCodester Performance Indicator System 1.0 SourceCodesterSourceCodester Performance Indicator System	NVD	Oct 25 15:17 UTC
CVE-2026-116055A vulnerability was detected in SourceCodester Performance Indicator System 1.0 Executive summary A SQL injection flaw was reported in the Performance Indicator System 1.0 from SourceCodester, a PHP and MySQLi web application. The advisory says an attacker needs no login to exploit it, which could expose or change database contents and disrupt the service. The advisory does not state a fixed version or a vendor patch, and it recommends code fixes such as prepared statements and input validation. Technical summary The flaw is SQL injection in the 'id' parameter of /opils/admin/deleteproduct.php, where user input is placed directly into SQL queries without validation. The advisory states that no login or authorization is required, and it provides a POST request example. Boolean-based blind and time-based blind techniques were demonstrated with sqlmap. The affected version is listed as V1.0, and no fixed version is stated. No vendor workaround is stated beyond the suggested remediation of parameterized queries, input filtering, least-privilege database accounts, and security audits. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/hubdk01/cve/issues/5 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SourceCodester SourceCodester Performance Indicator System NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	Low	1.2	CVE-2026-116054	A security vulnerability has been detected in SH3 SH3SH3 Módulo de Gestão/Módulo de Arrecadação	NVD	Oct 25 15:17 UTC
CVE-2026-116054A security vulnerability has been detected in SH3 Executive summary A weakness has been reported in SH3, a product whose Gestão and Arrecadação management modules are affected. The advisory says the flaw is hard to exploit remotely, but a public exploit has been disclosed and may be used. The vendor's recommendation is to upgrade the affected component to version 2026.0.2.0. Technical summary The flaw is classified as a password hash computed with insufficient computational effort, which weakens protection of stored credentials if an attacker obtains the hashes. The attack can be carried out remotely, but the advisory says it is highly complex and rated difficult to exploit. A public exploit has been disclosed. The advisory states that upgrading to version 2026.0.2.0 mitigates the issue; it does not state the vulnerable version range. No workaround, CVSS score, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects SH3 SH3 Módulo de Gestão/Módulo de Arrecadação NIST National Vulnerability DatabasePublished Oct 25, 2026 15:17 UTC Read the advisory
	High	8.8	CVE-2026-116211	YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated... Executive summary YesWiki versions from 4.5.0 before 4.7.0 contain an SQL injection flaw in the Bazar entry creation feature, where a date field from the request is inserted into a database query without escaping. The advisory rates it High with a CVSS score of 8.2 and says the fix is in version 4.7.0, so users should upgrade to 4.7.0 or later. Technical summary The flaw is CWE-89 SQL injection in PageManager::save(), where the date_maj_fiche POST field is concatenated raw into an INSERT SET statement via the forcedDate parameter instead of being escaped like the other columns. The advisory describes a network attack with low complexity and no privileges required on the authenticated path, and says an unauthenticated path via action=saisir_fiche works on a default install, with confidentiality impact rated High. Affected versions are stated as >= 4.5.0, < 4.7.0 in the package data and <= 4.6.7 in the description, and the patched version is 4.7.0. The advisory suggests escaping $forcedDate at the sink or validating date_maj_fiche as a strict datetime, but does not state any other workaround. Detection guidance is not stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-wjf7-hrf3-9gcx Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116208	YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other... Executive summary YesWiki, a wiki package used with ActivityPub federation, has a missing authorization flaw in its sync feature. A malicious federated server can cause a YesWiki administrator's routine sync to delete, overwrite, or create entries that belong to other federated actors. The advisory rates it High (8.1 CVSS) and states the fix status is not fixed, with the affected range given as versions 4.6.2 through 4.6.7; the advisory does not state a patched version for the sync path. Technical summary The flaw is CWE-862 (missing authorization) in ActivityPubService::syncActorPosts, which processes Delete, Update, and Create activities from a remote outbox without the assertOwns() and sameHost() checks used by the inbox handler, and runs a host-scoped garbage-collection delete. Exploitation requires an administrator to trigger the sync action (a GET request with no CSRF token), and the attacker needs no privileges on the wiki; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The advisory lists the affected range as >= 4.6.2 and <= 4.6.7 in the body, while the metadata says '< 4.7.0' and the patched version is listed as 4.7.0, but it also says the fix status is 'not fixed' for the sync path. Workarounds are stated as avoiding sync with untrusted actors and adding a CSRF token to the sync action, which the advisory suggests but does not confirm as implemented. No detection guidance is stated, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-cr64-h6xp-9g2j Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.8	CVE-2026-116207	YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116207YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest() Executive summary YesWiki, a wiki platform, has a critical flaw that lets anyone on the network read data from its database, including user credentials, without logging in. It can also be used to make the site unavailable by overloading the database. The advisory recommends updating to 4.7.0 or 5.0.0-alpha4, and restricting network access to the public Bazar entries API until then. Technical summary The flaw is an unauthenticated SQL injection (CWE-89) in the Bazar entries search API, reachable through GET /api/forms/{formId}/entries and /api/entries/bazarlist. A backtick in the query or searchfields field name breaks out of a backtick-quoted SQL alias, because the code uses mysqli_real_escape_string, which does not escape backticks. Injected SELECT subqueries can read any table the database user can access, and results are returned in the JSON response, while SLEEP-based subqueries can exhaust database connections. The advisory states the vector is network with low complexity and no privileges or user interaction, and gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a score of 9.1. Fixed versions are stated as 4.7.0 and 5.0.0-alpha4, while the affected range is inconsistently described as 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 in one place and as 4.6.7 through 5.0.0-alpha3 in the detailed text. Recommended interim mitigation is restricting network access to the public Bazar endpoints. Detection guidance is not stated, and no in-the-wild exploitation is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-ccp2-6q93-hggh Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116206	YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka... Executive summary YesWiki, a wiki package distributed through Composer, has a stored cross-site scripting flaw affecting versions from 4.2.0 up to but not including 4.7.0. The advisory rates it Moderate (CVSS 6.4) and says any logged-in user who can comment on a page can run scripts in the browsers of everyone who views that page, including administrators. The advisory lists 4.7.0 as the patched version, but its body says no fix exists in any published release, so administrators should confirm the status with the vendor before relying on an upgrade. Technical summary The flaw is CWE-79 stored cross-site scripting in comment bodies. Comments are saved with only whitespace trimming and are rendered with the Twig raw filter, and the wiki raw-HTML syntax is enabled by default through allow_raw_html set to true, so any authenticated user with comment access on a page can inject script through POST /api/comments. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and the advisory says no user interaction beyond viewing the page is needed. The header lists affected versions as >= 4.2.0, < 4.7.0 and patched version as 4.7.0, but the body says the confirmed affected range is >= 4.2.0, <= 4.6.7 and that the fix status is not fixed. The advisory suggests sanitizing comment bodies at storage or setting allow_raw_html to false as an interim step, but it does not state a fixed release that the body confirms. No detection guidance or indicators of exploitation in the wild are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-wq96-vjjh-hfc6 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.9	CVE-2026-116205	YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[\|URL]] wiki... Executive summary YesWiki versions before 4.7.0 contain an unauthenticated server-side request forgery flaw. Any anonymous visitor can make the YesWiki server fetch arbitrary internal or external URLs and read the responses back. The advisory rates it Moderate with a CVSS 3.1 base score of 5.3, and the fix is to upgrade to version 4.7.0. Technical summary The flaw is CWE-918 server-side request forgery in the wiki raw-inclusion syntax [[\|URL]], which fetches attacker-supplied URLs without scheme, host, or IP validation and echoes the response body. It is reachable without authentication through the page render handler using the content parameter, and also stored via a page body saved by a registered editor that fires when anonymous visitors view it. The advisory states the affected versions are less than 4.7.0 and the patched version is 4.7.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. A workaround is not stated, and no detection guidance beyond the proof of concept's access log observation is provided. No CVE ID is listed in the advisory, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-x9j5-r988-9jcc Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.2	CVE-2026-116204	YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116204YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or... Executive summary YesWiki, a wiki package distributed through Composer, has a cross-site request forgery flaw in its admin despam action. An unauthenticated attacker who gets a logged-in administrator to view a planted wiki page could permanently delete pages or restore old revisions, with the front page and configuration pages at risk. The advisory rates it High (CVSS 8.1) and recommends adding CSRF token checks, but it contradicts itself on which versions are fixed. Technical summary The flaw is CWE-352 in tools/security/actions/despam.php, where the destructive clean (suppr[]) and revision-restore (rev[]) branches are guarded only by a session-based UserIsAdmin() check, with no CSRF token, Origin, or Referer verification. The advisory describes the attack as requiring default configuration (default_write_acl='*', allow_raw_html=true), an attacker-created wiki page containing an auto-submitting form, and an administrator visiting that page; the session cookie's SameSite=Lax setting still allows the same-site POST. Affected versions conflict within the advisory: the header lists affected versions as before 4.7.0 with patched version 4.7.0, while the body states a confirmed affected range of <= 4.6.8 and says the fix status is not fixed. The advisory also says the v5 pre-release 5.0.0.0-alpha3 is affected, though it is outside the stable range it scopes. The stated CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H with a base score of 8.1. Recommended fixes are to require a CSRF token on the clean and revision-restore branches, with CSP script-src and form-action 'self' and a permissions.action entry for despam as defense-in-depth. Detection guidance and exploitation in the wild are not stated, and the advisory notes no CVE is assigned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-cv88-hx5q-vq72 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116203	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116203YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding Executive summary YesWiki versions before 4.7.0 contain a stored cross-site scripting flaw in the filtertags action. An anonymous visitor who can create or edit a page could store script that runs for every later viewer of that page. The advisory rates it High and says the fix is to upgrade to version 4.7.0. Technical summary The flaw is stored cross-site scripting (CWE-79) in the filtertags action, where attacker-controlled token values are echoed into page HTML without output encoding, including the button inner text, the title parameter, and the tagbadges value. The payload is injected through the action attribute syntax, which the wakka formatter processes before its allow_raw_html check, so it bypasses that control. Preconditions stated are that default page ACLs on a fresh install are read=* and write=*, and the advisory reports anonymous exploitation using a hashcash token fetched without authentication. Affected versions are stated as before 4.7.0 and the patched version as 4.7.0. The advisory does not state a workaround. It recommends output-encoding the echo sites in tools/tags/actions/filtertags.php. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-f53x-3gqx-xq76 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.1	CVE-2026-116202	YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... YesWikiyeswiki	NVD	Oct 25 14:17 UTC
CVE-2026-116202YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar... Executive summary A stored cross-site scripting flaw in YesWiki lets a low-privilege authenticated user upload a malicious SVG file through an image field, and the script runs for people who open the entry or the stored file. The advisory says the earlier fix for a related form-upload issue did not cover this image field, so the flaw remains on the patched version. The advisory lists the affected version as before 4.7.0 and the patched version as 4.7.0, and it recommends applying the same upload sanitization to the image field. Technical summary This is a stored cross-site scripting issue (CWE-79) caused by unrestricted SVG upload through the ImageField class in tools/bazar/fields/ImageField.php, which stores files without the sanitizer that the sibling FileField class received in the earlier fix. The attacker needs a valid authenticated account (PR:L) and user interaction (UI:R), and posts a multipart request to /api/entries/{formId} with an SVG file that is then served as image/svg+xml on the wiki origin. The advisory states the affected versions as less than 4.7.0 and the patched version as 4.7.0, and it says the fix for this specific field is not yet present. No workaround is stated. No detection guidance is stated beyond the proof-of-concept description. The advisory does not state any exploitation in the wild or a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YesWiki/yeswiki/security/adv…/GHSA-c5q6-7233-3v6g Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YesWiki yeswiki NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.7	CVE-2026-116201	Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs... Executive summary Snipe-IT versions before 8.5.0 contain a flaw that lets an attacker reuse a captured SAML login assertion to obtain multiple valid sessions for the same user. The advisory rates the severity as Moderate and says the fix is in version 8.5.0. Technical summary This is a race condition (TOCTOU, CWE-367) in the SAML assertion nonce check, enabling capture-replay (CWE-294). The nonce check and insert were not atomic and the saml_nonces.nonce column had a non-unique index, so two concurrent POST /saml/acs requests with the same captured assertion could both log in. Affected versions are stated as <= 8.4.1 and the patched version is 8.5.0, with fixes in commit 5b0a779c07 and a unique index migration that runs saml:clear_expired_nonces first. Preconditions are SAML SSO enabled with valid IdP metadata, an attacker holding one valid assertion, and the ability to submit it twice within a sub-second race window. No workaround is stated. Exploitation in the wild is not stated, and no CVE ID is listed (the advisory says No known CVE). Specific detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-w49g-f2jc-qxhg Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	8.2	CVE-2026-116200	Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116200Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds Executive summary Snipe-IT versions up to and including 8.6.2 can send LDAP login credentials, including the service account password and end-user passwords, in cleartext when an attacker on the network path interferes with the encrypted connection setup. The advisory rates the issue Moderate and recommends upgrading to version 8.6.3 or later, which fixes the flaw. Technical summary The flaw is a cleartext transmission of sensitive information issue (CWE-319) caused by an algorithm downgrade during negotiation (CWE-757). In Ldap::connectToLdap(), the return value of ldap_start_tls() was ignored, so when StartTLS failed, the code still performed an ldap_bind() in cleartext. Exploitation requires LDAP authentication enabled with ldap_tls = 1, and an attacker on the network path between Snipe-IT and the LDAP server, who answers the StartTLS request with a Protocol error or the server does not offer StartTLS. Affected versions are stated as <= 8.6.2 and the patched version is 8.6.3, fixed in commit 91ea06904f. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and no CVSS score is given. No detection guidance is provided beyond the stated exploitability conditions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-wx48-r3qh-jvh5 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Critical	9.2	CVE-2026-116199	Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116199Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email... Executive summary A flaw in Snipe-IT, an IT asset management application, lets users who have been deactivated sign in through Google single sign-on if their Google account is still active. The advisory rates it Moderate and says it affects versions 8.6.2 and earlier. The vendor recommends upgrading to version 8.6.3 or later. Technical summary The Google SSO callback in GoogleAuthController::handleGoogleCallback looks up the local user by username matching the Google account email and logs them in without checking the activated flag, which is a missing authorization check (CWE-285) and an improper authentication weakness (CWE-287). The advisory says exploitation requires Google SSO to be enabled, a deployment that uses email-as-username or an email-shaped username on the account, a deactivated account, and a still-live Google identity. Affected versions are stated as 8.6.2 and earlier, and the fix is in 8.6.3 (commit 5fea2fadc0), which checks the activated flag after lookup. The advisory does not state a CVE ID, a CVSS score, or any workaround other than upgrading. It does not state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-xf36-wx48-5rqp Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	5.3	CVE-2026-116198	Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... grokability, Snipe-ITgrokability snipe-it, Snipe-IT	NVD	Oct 25 14:17 UTC
CVE-2026-116198Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers... Executive summary Snipe-IT versions 8.6.3 and earlier have a flaw in the API asset-creation path that can store sensitive custom field values as plaintext when the caller lacks the permission needed to write encrypted fields. The advisory rates the issue Low and says it is fixed in version 8.7.0, which the vendor recommends installing. Technical summary The flaw is classified as missing encryption of sensitive data (CWE-311) and an always-incorrect control flow implementation (CWE-670) in Api\AssetsController::store. When the caller lacks assets.view.encrypted_custom_fields, the encryption call is skipped and the unencrypted value is written to the database column because the block lacks a continue statement, unlike the update path. The advisory states the affected versions are 8.6.3 and earlier and the fixed version is 8.7.0, with the fix in commit 34dafe9eed. The advisory does not state a CVE ID, a CVSS score, or any workaround. It also does not state whether exploitation has been observed or provide specific detection guidance beyond the description of the impact. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/grokability/snipe-it/securit…/GHSA-jh4g-98fm-jcqc Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects grokability Snipe-IT grokability snipe-it Snipe-IT NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Low	2.1	CVE-2026-116197	Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... edgelesssys, Edgeless Systemsedgelesssys contrast, Edgeless Systems Contrast	NVD	Oct 25 14:17 UTC
CVE-2026-116197Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over... Executive summary Edgeless Systems Contrast versions from 1.21.0 before 1.25.0 contain a flaw in the imagepuller component that can select the wrong registry configuration when both a concrete domain and its parent wildcard are configured. The advisory rates it Low, with a CVSS v3.1 base score of 2.6, and the vendor's fix is to upgrade to 1.25.0 or later. Technical summary The flaw is classified as CWE-1289, improper validation of unsafe equivalence in input, in the imagepuller registry selection logic. It is exploitable only when the registry pull configuration contains both a concrete domain (for example registry.example.com) and its parent domain as a wildcard (for example .example.com), which the advisory describes as very unlikely in practice. The advisory lists affected versions as 1.21.0 through 1.24.1 and the patched version as 1.25.0, with the fix made in pull request #2682. The CVSS v3.1 vector is AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, giving a score of 2.6. The advisory states a workaround: replace the wildcard entry with a list of concrete entries. No detection guidance is stated, and no CVE identifier is stated (the advisory says No known CVE). Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/edgelesssys/contrast/securit…/GHSA-w4p9-c7h8-jvgr Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects edgelesssys Edgeless Systems edgelesssys contrast Edgeless Systems Contrast NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	Medium	6.0	CVE-2026-116196	Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... rclone, Backblazerclone, Backblaze B2	NVD	Oct 25 14:17 UTC
CVE-2026-116196Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from... Executive summary Rclone, an open-source tool for copying and syncing files to cloud storage, has a credential exposure flaw in its Backblaze B2 backend. When a custom download host is configured, the live account authorization token and SSE-C encryption keys can be sent over cleartext or to another host during an HTTP redirect, and the advisory rates it Moderate with a CVSS 3.1 base score of 5.3. The advisory says the fix is to update to v1.75.2, with workarounds that include enforcing HTTPS on the download URL and using least-privilege application keys. Technical summary This is a cleartext transmission of sensitive information issue (CWE-319) in the rclone b2 backend, where the default Go HTTP client follows redirects from the custom --b2-download-url host. A same-host HTTPS-to-HTTP redirect causes the Authorization header to be resent in cleartext, and the SSE-C customer key headers are forwarded to any redirect target host. The advisory lists rclone versions before v1.75.2 and states affected versions as <= v1.75.0 with patched version v1.75.2. The attack vector is Adjacent with high complexity, no privileges or user interaction required, and CVSS 3.1 vector AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The Remediation section says to update to v1.75.1, which conflicts with the patched version v1.75.2 listed elsewhere in the advisory. Workarounds are to enforce an explicit https:// scheme on --b2-download-url, block plaintext redirects at the CDN, unset the download URL, and use scoped application keys. No CVE identifier is stated in the advisory, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-gpw7-77cq-9f72 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone Backblaze rclone Backblaze B2 NIST National Vulnerability DatabasePublished Oct 25, 2026 14:17 UTC Read the advisory
	High	7.0	CVE-2026-116195	Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... rclone, github.com/rclone/rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116195Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment... Executive summary A flaw in the rclone file sync tool lets an attacker who can create a specially named directory in the source tree change ownership and timestamps of a directory outside the destination the operator chose. The advisory rates it Moderate, with a CVSS score of 7.4 for the root-run case and a conservative estimate of about 6.8. The advisory recommends fixing the trimming logic so the name is checked after trimming, and it notes the affected versions are 1.75.1 and earlier, with 1.75.2 as the patched version. Technical summary This is a path traversal (CWE-22, CWE-59) in rclone's local backend, where translateLink trims the .rclonelink suffix from the OS path after the containment check, so validated paths can be shifted one directory up. It requires a local destination with -l and --metadata, and an attacker who can create a directory named .rclonelink in the copied tree. The advisory reports the escape affects metadata only (ownership, timestamps, xattrs) because content writes are blocked by os.Root hardening, and that a root-run case allows ownership change. It lists affected versions as <= 1.75.1 and patched version 1.75.2, but also states that v1.75.0 and master HEAD 4479a3b are affected by its own testing. The suggested fix is to trim the remote name before confinement and re-validate the final path. The advisory does not state a workaround, and it does not state any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-55qp-jrwr-x827 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone github.com/rclone/rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116194	Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... rclone, pCloudrclone, pCloud backend	NVD	Oct 25 14:16 UTC
CVE-2026-116194Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts... Executive summary Rclone versions from 1.52.0 before 1.75.2 contain a cross-site request forgery flaw in the pCloud backend's localhost OAuth setup callback. A malicious web page open in a user's browser during the pCloud authorization flow can silently point the user's pCloud remote at an attacker-controlled host, causing later file transfers to go to that host. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is to upgrade to v1.75.2. Technical summary The flaw is a missing state check (CWE-352 cross-site request forgery) on rclone's localhost OAuth callback at 127.0.0.1:53682 for the pCloud backend, combined with trust in an unauthenticated hostname parameter (CWE-346). An attacker needs a victim to load a malicious page while rclone config or rclone authorize pcloud is running, and the advisory notes Chrome Private Network Access can block subresource requests while top-level navigation is not blocked. Affected versions are stated as >= 1.52.0 and <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround. Detection guidance beyond the proof of concept is not stated, and no CVE identifier is listed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-hvpr-p4pv-4f46 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone pCloud rclone pCloud backend NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116193	Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116193Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests Executive summary The advisory says rclone, an open-source file synchronization tool, has an authentication bypass in its serve webdav feature affecting versions from 1.64.0 before 1.75.2. An unauthenticated remote attacker can learn whether arbitrary paths exist and whether they are files or folders, though file contents and writes are not reachable. The advisory rates it Moderate with a CVSS v3 base score of 5.3 and recommends upgrading to 1.75.2. Technical summary The flaw is missing authentication (CWE-306) caused by the basicAuth and MiddlewareAuthCustom HTTP middlewares in lib/http skipping all OPTIONS requests rather than only genuine CORS preflights. An unauthenticated network attacker can send OPTIONS requests to rclone serve webdav and read the Allow header, which differs for existing files, existing collections, and missing paths, enabling namespace enumeration. The advisory states the affected range as >= 1.64.0 and <= 1.75.1, with patched version 1.75.2. No workaround is stated. The advisory does not state whether the issue is exploited in the wild, and it gives no detection guidance beyond the proof of concept. The advisory says rclone serve http and other listed servers are not affected. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-gj73-fh6v-92fj Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116192	rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116192rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by... Executive summary Rclone versions from 1.37 before 1.74.2 contain a server-side request forgery flaw that lets unauthenticated attackers, when the optional --rc-serve feature is enabled without RC authentication, redirect HTTP and NetStorage backend requests to hosts they choose. The advisory rates it Moderate with a recommended CVSS 3.1 score of 5.9. The vendor-side fix is to upgrade to version 1.74.2, which the advisory lists as the patched version. Technical summary This is a server-side request forgery (CWE-918) caused by a scheme-relative named-remote root, such as //host/path, that replaces the configured URL authority for the http and netstorage backends. Exploitation requires --rc-serve enabled, no RC HTTP authentication, a reachable RC listener, and knowledge of an existing http or netstorage remote name; the advisory notes the default bind is loopback and that --rc-no-auth is not set in the tested configuration. Affected versions are stated as 1.37 or later up to and including 1.74.1, with patched version 1.74.2. The advisory says the attacker can cause same-scheme HEAD and GET requests to attacker-selected hosts with response bodies returned, send configured HTTP headers to those hosts, and obtain time-bound NetStorage signatures, but no write primitive is demonstrated. A proposed origin-check patch is described, but the advisory does not state a workaround, and no detection guidance is given. Whether the issue is exploited in the wild is not stated, and no CVE identifier is listed on the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-xqmq-v4wj-rw5m Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116191	Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... rclone, ncwrclone, ncw rclone	NVD	Oct 25 14:16 UTC
CVE-2026-116191Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..'... Executive summary Rclone versions before 1.75.2 contain a path traversal flaw in its WebDAV server (rclone serve webdav) that lets an unauthenticated remote client create, overwrite, and move files and directories above the folder that rclone is configured to serve. The advisory rates it High with a CVSS 3.1 base score of 7.5, and it describes the impact as integrity and availability rather than data disclosure. The vendor's fix is upgrading to version 1.75.2. Technical summary The flaw is a CWE-22 path traversal caused by unvalidated '..' path elements in WebDAV requests, such as MKCOL /. which plants a directory node whose backend path is '..'. The attack needs no authentication, which the advisory says is the default for rclone serve webdav, and requires two HTTP requests (an MKCOL followed by a PUT). The advisory says it applies when the served remote has a non-empty root and the backend joins root and remote before encoding, such as webdav, ftp, sftp, http, or memory, and that local and s3 backends are not affected. Affected versions are stated as <= 1.75.1 and the patched version as 1.75.2; the advisory says the lower bound is not established. Workarounds stated: running with --read-only blocks the attack (the advisory reports MKCOL returning 405), and the advisory proposes code fixes that add path checks. Detection guidance beyond the proof-of-concept request sequence is not stated, and no CVE identifier is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-44pm-2q5p-fm63 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116190	rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116190rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to... Executive summary The rclone tool's WebDAV backend can send a custom credential header to a different host when the configured WebDAV server issues a cross-host redirect, which could expose a reusable login credential. The advisory rates it Low, with a CVSS 3.7 score and a note that no CVE is assigned. The advisory states that affected versions are v1.56.0 through v1.75.1 and that v1.75.2 is the patched version. Technical summary This is an information disclosure flaw, classified as CWE-200 and CWE-522, in which operator-configured custom headers set via the WebDAV headers option are re-sent on cross-host HTTP 3xx redirects. Exploitation requires that an attacker can influence the server's redirect response, such as through an open redirect, a malicious or compromised endpoint, or an on-path position on a cleartext or same-host hop. The advisory states the fixed version is v1.75.2 and that the default configuration is affected, independent of the auth_redirect option. Standard Authorization headers are stripped by Go across registrable domains, but custom-named headers are not. The advisory does not state a workaround beyond avoiding reusable secret headers on remotes that may redirect to other hosts, and it does not state any detection guidance or known exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-3rqf-7h69-gg5v Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.7	CVE-2026-116189	rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116189rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned... Executive summary A flaw in the stable self-update feature of rclone, a command-line file sync tool, lets an attacker who already controls the trusted release download path install a malicious replacement program, affecting versions 1.55.0 through 1.75.1. The advisory rates the issue High, with a CVSS 3.1 score of 7.5. The advisory recommends applying the proposed fix, which resolves the checksum only from the signed portion of the response, but it states that no upstream fixed release was available at the time of testing and the listed patched version is 1.75.2. Technical summary The vulnerability is an improper verification of a cryptographic signature (CWE-347). The verifier checks a PGP clearsigned SHA256SUMS block but then looks up the archive hash in the original response buffer, which can include unsigned bytes before the signed block, so an attacker-supplied unsigned checksum line is accepted. The attack requires control of authenticated responses from the stable release distribution path, such as origin, CDN, or TLS termination compromise, or interception with a trusted certificate, and user interaction in running stable selfupdate without --check. Affected versions are stated as >= 1.55.0 and <= 1.75.1, with patched version 1.75.2. The advisory states a proposed fix of resolving the hash from block.Bytes, which was tested but is not described as shipped upstream. Workarounds are not stated. Detection guidance beyond the proof-of-concept test is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-w33h-3qgq-8mv8 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116188	rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit rclonerclone	NVD	Oct 25 14:16 UTC
CVE-2026-116188rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit Executive summary The advisory says rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow that lets an unauthenticated network client bypass the configured memory limit for multipart uploads, which can exhaust memory on the host running the service. The severity is rated Moderate, and the advisory lists 1.75.2 as the patched version. Users should upgrade to 1.75.2 or later. Technical summary This is an integer overflow (CWE-190) combined with unbounded resource allocation (CWE-770) in the multipart reorder-memory accounting of rclone serve s3. An attacker who can reach the S3 listener opens two concurrent multipart PUT requests for the current part, each declaring 5,000,000,000,000,000,000 bytes, and withholds the bodies, so the signed int64 accounting field wraps negative and out-of-order parts later pass the capacity check. The advisory says affected versions are 1.75.0 up to but not including 1.75.2, with the patched version listed as 1.75.2. Exploitation needs no credentials when serve s3 runs without --auth-key or --auth-proxy, and authenticated deployments require an accepted S3 credential. The advisory states that no workaround is available beyond binding to a trusted interface, which it says does not fix the arithmetic, and that disabling streaming is not a safe mitigation. Detection guidance is not stated, and the CVSS v3.1 base vector given is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, with an overall score shown as 5.3. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-qjw8-8hmp-c3m6 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.1	CVE-2026-116187	Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... rclone, ncwrclone	NVD	Oct 25 14:16 UTC
CVE-2026-116187Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants'... Executive summary Rclone versions from v1.68.0 before v1.75.2 contain an authorization bypass in its S3 server when run with --auth-proxy, letting one authenticated tenant interfere with another tenant's in-flight multipart uploads. The advisory rates it Moderate with a CVSS score of 6.4, and the recommended fix is to upgrade to v1.75.2. Technical summary The flaw is CWE-639, an authorization bypass through a user-controlled key. The multipart operations UploadPart, CompleteMultipartUpload and AbortMultipartUpload look up uploads by upload ID alone and do not check the caller's tenant, so a tenant who learns another tenant's bucket, object and uploadID can inject data into, complete or abort that upload. The advisory says the attacker must be an authenticated tenant on a server using --auth-proxy with several keys, and must obtain the victim's tuple, which it demonstrates through ListMultipartUploads while owning a same-named bucket. Affected versions are stated as >=v1.68.0 <= 1.75.1, with patched version v1.75.2. The advisory does not state a workaround, and detection guidance is not stated. It notes that at-rest content is not read and the destination key is set by the victim at initiate. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rclone/rclone/security/advis…/GHSA-35g6-9fjv-rmx5 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rclone ncw rclone NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-116186	OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116186OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only... Executive summary The advisory says OpenRemote core (openremote-manager) before 1.31.0 lets a registered edge gateway write and delete assets in any realm, breaking tenant isolation. The advisory gives two different severity ratings: it reports the finding as High, with a base score of 9.6 (Critical) under CVSS v3.1, while the NVD record and the GitHub advisory list it as Low. The fix is to upgrade to version 1.31.0. Technical summary The flaw is an authorization bypass through a user-controlled key: inbound gateway events skip the standard client event authorization, and the only mapping of gateway asset IDs (mapAssetId) shifts the first two characters by a per-gateway offset, which is reversible by anyone who knows the gateway ID. The attacker needs a registered, enabled gateway's service-user credentials, which a realm administrator can obtain, and then can send crafted AttributeEvent or DELETE AssetEvent messages over the gateway session to change attributes or delete leaf assets in other realms. The advisory states the affected versions as less than 1.31.0 and the patched version as 1.31.0, and it says the issue is present in all releases up to 1.26.1. It does not state a workaround. The advisory includes a proof-of-concept that is a standalone re-implementation of the ID transform and does not run against a live system, and it states that a full dynamic test was not performed. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-8pjc-wq2p-3xr4 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116185	OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116185OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via... Executive summary OpenRemote core versions before 1.31.0 contain an authorization bypass that lets an authenticated user in one realm read active gateway tunnel information belonging to another realm. The advisory rates this Moderate (CVSS 5.0) and states that the fix is to upgrade to version 1.31.0. The attacker must already know or guess a gateway asset ID in the victim realm. Technical summary The flaw is an authorization bypass (CWE-639, CWE-284) in the REST endpoint GET /gateway/tunnel/{realm}/{id}, where getGatewayActiveTunnelInfos does not filter returned tunnels by realm, unlike its sibling methods. Any authenticated non-restricted user can exploit it over the network by passing their own realm in the path and a gateway ID from another realm, leaking target host, target port, and gateway routing data. Affected versions are stated as less than 1.31.0 (package io.openremote:openremote-manager), with the patched version given as 1.31.0. The advisory states no workaround. It also states that exploitation in the wild is not stated, and that the finding was confirmed by static source comparison only, not dynamically executed. Detection guidance beyond the proof-of-concept request pattern is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-p5wh-9wx4-w5f3 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116184	OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... openremoteopenremote core, openremote-manager	NVD	Oct 25 14:16 UTC
CVE-2026-116184OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the... Executive summary OpenRemote versions before 1.31.0 contain an authorization bypass that lets a user with admin rights in one realm impersonate a gateway that belongs to a different realm. The advisory rates it Low, with a CVSS v4 base score of 2.1, and the patched version is 1.31.0. Technical summary The flaw is an authorization bypass (CWE-639, with CWE-862 also listed) in GatewayService, where gateway websocket events are routed using only the gateway ID and are not checked against the realm of the GatewayConnector. An attacker needs a realm admin account with WRITE:ADMIN in one realm and knowledge of a gateway ID in another realm; they then create a service user named gateway-GATEWAY_ID in their own realm and connect over websocket. The advisory says the attacker could create SSH tunnels during initial sync and overwrite descendant assets of the Gateway asset, though it cannot read existing assets. Affected versions are stated as less than 1.31.0 and the patched version is 1.31.0. No workaround is stated, and no detection guidance is stated. The advisory states no known CVE ID exists, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openremote/core/security/adv…/GHSA-2j4x-qh6q-q8mm Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openremote openremote core openremote-manager NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116183	phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... thorsten, phpMyFAQthorsten phpMyFAQ, phpMyFAQ	NVD	Oct 25 14:16 UTC
CVE-2026-116183phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying... Executive summary An unauthenticated visitor can modify or delete any visitor-submitted question in phpMyFAQ versions before 4.1.10 (the advisory lists affected versions as up to and including 4.2.0-beta). The advisory rates it High at CVSS 7.5 under the default configuration, and Critical at 9.1 when the option to delete open questions after answering is enabled. The advisory recommends upgrading to 4.1.10, which is listed as the patched version. Technical summary The flaw is an object-level authorization bypass (CWE-639) in POST /api/faq/create, where the client-supplied openQuestionID is cast to an integer and used directly as the key for UPDATE or DELETE queries on the faqquestions table, with no ownership, visibility, or permission check. Exploitation requires no account or CSRF token, only solving the graphical CAPTCHA, and the advisory states no user interaction is needed. With records.enableDeleteQuestion false (the shipped default), the attacker can rewrite a question's category and answer link (CVSS 7.5, integrity impact only); with it true, the question is permanently deleted (CVSS 9.1). The advisory lists the affected versions as <= 4.2.0-beta and the patched version as 4.1.10. Workarounds are not stated beyond the suggested code fix, and no detection guidance is given. No CVE ID is assigned in the advisory (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/thorsten/phpMyFAQ/security/a…/GHSA-9m55-g84r-x6v7 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects thorsten phpMyFAQ thorsten phpMyFAQ phpMyFAQ NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116182	phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers thorsten, phpMyFAQthorsten phpMyFAQ, phpMyFAQ	NVD	Oct 25 14:16 UTC
CVE-2026-116182phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers Executive summary phpMyFAQ versions before 4.1.10 contain a server-side request forgery flaw in the PDF export feature, which can make the server fetch external images referenced in FAQ answers. The advisory rates it Moderate with a CVSS overall score of 5.0, and the fix is to update to version 4.1.10. Technical summary The flaw is server-side request forgery in the PDF export feature, which fetches image URLs in FAQ answers during PDF generation; in the tested setup a loopback-only HTTP service was requested and its response embedded in the PDF. Exploitation requires that localhost be listed in records.allowedMediaHosts and that an attacker can create or modify FAQ content, and the advisory states the full chain was not proven to be achievable by an entirely unauthenticated attacker. Affected versions are stated as <= 4.1.9 and the patched version as 4.1.10. The advisory does not state a workaround, and the CVSS vector given is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N. No CVE identifier is listed (the advisory reports 'No known CVE'), and no detection guidance beyond the proof-of-concept steps is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/thorsten/phpMyFAQ/security/a…/GHSA-8wmv-9c4g-p5mg Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects thorsten phpMyFAQ thorsten phpMyFAQ phpMyFAQ NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-116181	vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116181vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by supplying out-of-vocabulary stop_token_ids Executive summary The advisory says vLLM versions from 0.20.1 before 0.29.0 contain a flaw in which a single crafted request with an out-of-vocabulary stop token ID can crash the inference engine and interrupt service for other users. The advisory rates the issue Moderate with a CVSS v3.1 base score of 6.5, and the fix is to upgrade to 0.29.0 or later. Technical summary The weakness is improper input validation (CWE-129, with related CWE-248, CWE-400 and CWE-787) in stop_token_ids, which were checked only to be integers and not against the model vocabulary. A remote attacker who can send OpenAI chat or completion requests, or the legacy generate endpoint, with an out-of-vocabulary ID can trigger an assertion and terminate the engine on the default V1 runner, or write outside the logits buffer on the V2 runner. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, so low privileges are required. Affected versions are stated as greater than or equal to 0.20.1 and less than 0.29.0, and the patched version is stated as 0.29.0, with the fix in PR #54196 that rejects invalid IDs as request errors. The advisory does not state any workaround, and it gives no detection guidance or information about exploitation in the wild. No CVE identifier is listed (it states 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-w9r6-29q4-pvpr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.3	CVE-2026-116180	vLLM from 0.8.5 before 0.31.0 has a denial of service flaw vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116180vLLM from 0.8.5 before 0.31.0 has a denial of service flaw Executive summary The advisory says vLLM versions from 0.8.5 before 0.31.0 contain a denial of service flaw. A single crafted API request using prompt_logprobs against a connector-cached prefix can crash the engine process, dropping all in-flight requests from other users on that engine. The advisory rates it High (7.7 CVSS as stated), and the patch replaces uninitialized memory with zero and negative infinity defaults; the advisory states the fix has not landed upstream yet. Technical summary The flaw is classed as use of uninitialized resource (CWE-908) leading to uncontrolled resource consumption (CWE-400) in LogprobsTensors.empty_cpu() in vllm/v1/outputs.py, which uses torch.empty(). Exploitation requires the V1 engine with a KVConnectorBase_V1 subclass that reports externally computed tokens, plus a request with prompt_logprobs (or logprobs with echo=true); the advisory lists network attack vector, low complexity, and low privileges. The proposed patch uses torch.zeros() and torch.full(-inf), and the advisory says a Fixes trailer should reference commit 3aee6573dc58. Workarounds stated are disabling KV connectors, stripping prompt_logprobs, logprobs and echo at a gateway, or applying the patch. The advisory lists affected versions as v0.8.5 onward through HEAD, and the patched version is written as >= 0.31.0. Detection guidance is not stated, and whether the fix has been released in a tagged version beyond the advisory's note that main is still affected is not stated beyond that. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: PyPI vllm Summarized from github.com/vllm-project/vllm/security/a…/GHSA-rhcx-5729-88vg Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116179	vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116179vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the video/jpeg frame-count cap by overriding num_frames through... Executive summary A flaw in vLLM, an open-source system for serving large language models, lets API clients bypass a frame-count limit on inline video uploads. The advisory says it can cause excessive memory and CPU use and can crash or OOM-kill the serving process, and it is rated High. The fix rejects per-request media decoder overrides by default, and the advisory says deployments should update to version 0.31.0 or later. Technical summary The weakness is CWE-770, allocation of resources without limits or throttling, in VideoMediaIO.load_base64 for video/jpeg input. A client that can call the chat endpoint can set media_io_kwargs.video num_frames to -1 or a very large value, which bypasses the frame cap and makes the API frontend decode and stack every frame in memory. Affected versions are stated as 0.18.0 up to but not including 0.31.0, and the patched version is stated as 0.31.0 or later; the advisory notes the issue was confirmed on 0.19.1. The fix is PR #58830, which rejects non-empty per-request media_io_kwargs by default, and deployments that trust their clients can opt in with --trust-request-mm-kwargs. The advisory does not state a CVSS score, a CVE assignment beyond 'No known CVE', any workaround beyond the flag described, exploitation in the wild, or specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-4m6g-h9mv-wqjc Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116178	vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116178vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the... Executive summary A denial of service flaw in vLLM, an open-source engine for running large language models, lets a remote attacker crash the engine by sending crafted multimodal request data. The advisory rates it Moderate with a CVSS v3.1 base score of 5.9, and says the fix is to upgrade to vLLM version 0.30.0 or later. Technical summary The flaw is improper input validation (CWE-20) in the disaggregated multimodal /inference/v1/generate endpoint, which accepted client-supplied kwargs_data, mm_hashes, and mm_placeholders without checking that they describe a consistent prompt layout. Overlapping or repeated placeholder ranges can reach model code and crash the engine, as reproduced with Qwen2.5-VL-3B-Instruct. Affected versions are stated as greater than or equal to 0.20.0 and less than 0.30.0, and the patched version is stated as greater than or equal to 0.30.0, with the fix in PR #51898. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, requiring no privileges or user interaction. No workaround is stated, no CVE ID is assigned, and no detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-34qw-q2h2-jp3m Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116177	vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... vllm-project, Vllm, Pillowvllm-project vllm, vLLM, Pillow	NVD	Oct 25 14:16 UTC
CVE-2026-116177vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust memory because the Nemotron-VL... Executive summary vLLM, an open-source system for serving large language models, has a flaw in its Nemotron-VL image processors that lets an unauthenticated remote user exhaust server memory and deny service to other users on the same instance. The advisory rates the issue High, and the fix is to upgrade to vLLM 0.25.0 or later. Technical summary The weakness is CWE-400, uncontrolled resource consumption. Two Nemotron-VL processor modules set Pillow's Image.MAX_IMAGE_PIXELS to None at import time, which disables Pillow's decompression-bomb guard for the whole process. An unauthenticated caller who can reach /v1/chat/completions on an instance that has imported either processor can submit a crafted image that decompresses to a very large size, potentially causing the worker to be killed by the out-of-memory handler. Affected versions are listed as 0.10.2 before 0.25.0 in the NVD description and as <= 0.8.5 in the GitHub advisory, which the advisory does not reconcile; the patched version is stated as 0.25.0 or later. The fix in PR #47010 removes the module-level assignments and adds a decoded pixel-count limit configurable through VLLM_MAX_IMAGE_PIXELS. No workaround beyond upgrading is stated, and no detection guidance is stated. No CVSS score is stated, and the advisory gives severity as High. No known CVE ID is listed in the GitHub text, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-mm38-5g96-7j6x Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm Pillow vllm-project vllm vLLM Pillow NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.8	CVE-2026-116176	vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... vllm-project, Vllmvllm-project vllm, vLLM, Vllm P2pNcclConnector	NVD	Oct 25 14:16 UTC
CVE-2026-116176vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the... Executive summary The advisory says vLLM versions from 0.9.2 before 0.24.0 contain a server-side request forgery flaw that lets an API caller make the server open outbound connections and leak key-value cache data from requests processed by a prefill worker using the P2pNcclConnector. It is rated High severity. The recommended fix is to upgrade to vLLM 0.24.0, which removes the affected connector. Technical summary The flaw is classified as CWE-918 server-side request forgery. The OpenAIServing._base_request_id function copies the X-Request-Id HTTP header into the request_id without validation, and P2pNcclConnector.parse_request_id extracts an arbitrary host and port from it using a permissive regex, letting the caller force outbound ZMQ connections and NCCL communicator setup to an attacker-chosen host. The advisory states the affected range as >= 0.9.2, < 0.24.0 when using P2pNcclConnector, with the patched version 0.24.0. The precondition is a prefill worker configured with a kv_producer role and the P2pNcclConnector, and a valid API key or no key if --api-key is unset. PR #44854 removed the affected connector, and the advisory also describes a proposed fix of stripping the header and adding a CIDR or hostname allow-list. The advisory does not state any detection guidance or exploitation in the wild, and no CVSS score is stated beyond the High severity rating. No CVE identifier is given (it says 'No known CVE'). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-vfp2-c8pq-v6h6 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM Vllm P2pNcclConnector NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.1	CVE-2026-116175	vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116175vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls load_audio without the max_duration_s decoded-duration... Executive summary The vLLM inference server, versions from 0.19.0 before 0.24.0, is affected by a decompression bomb flaw in its chat audio input handling. A remote user who can send chat completion requests can submit a small compressed audio file that expands into a very large decoded output, which can exhaust memory or degrade availability. The advisory rates it Moderate with a CVSS 3.1 base score of 6.5, and the recommended remedy is upgrading to vLLM 0.24.0. Technical summary The weakness is CWE-409, improper handling of highly compressed data, in the multimodal AudioMediaIO path used by /v1/chat/completions for input_audio data URLs and audio_url media. The decoder duration guard added for speech-to-text is not passed through this path, so load_audio is called without a max_duration_s bound. The attack vector is network, with low attack complexity and low privileges required (PR:L), and the advisory notes that PR:N may apply if chat completions lack API-key authentication. Affected versions are stated as >= 0.19.0, < 0.24.0, and the patched version is 0.24.0. The advisory does not state a workaround beyond noting that --allowed-media-domains, fetch timeouts, and HTTP body limits do not enforce a decoded duration budget. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-r45p-7qwx-qwjw Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116174	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116174vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that forwards unchecked prompt token IDs... Executive summary The advisory says vLLM versions from 0.22.0 before 0.24.0 contain an input validation flaw in the Rust gRPC Generate and GenerateStream service that lets a single request with an invalid prompt token ID crash the inference engine and leave the server unhealthy. The advisory rates it Moderate, and the vendor's recommended fix is to upgrade to vLLM 0.24.0, which is listed as the patched version. Technical summary This is improper input validation (CWE-20) with an uncontrolled resource consumption angle (CWE-400). The gRPC Generate and GenerateStream handlers forward pre-tokenized prompt token IDs to the engine without checking them against tokenizer or model vocabulary bounds, so an out-of-vocabulary value such as 9000000 can trigger a fatal EngineCore failure and make the server unhealthy. The attack vector is network access to the Rust gRPC endpoint with no privileges or user interaction stated as required in the vector used by the publisher; the advisory notes the vector would be PR:L if clients must be authorized. Affected versions are >= 0.22.0, < 0.24.0, with patched version 0.24.0. The advisory's suggested CVSS 3.1 scores are 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and 6.5 with PR:L, while the NVD overall score shown is 5.9 with AC:H. Workarounds are not stated. Exploitation in the wild is not stated. Detection guidance is not stated beyond the suggested fix of returning INVALID_ARGUMENT for out-of-range token IDs. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-w2v2-5662-8v5q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116173	vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116173vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust... Executive summary Versions of vLLM from 0.22.0 before 0.24.0 contain a denial-of-service flaw that lets a remote attacker crash the engine core with a single crafted request. The advisory rates it Moderate, with a CVSS 5.9 score, and the fix is to upgrade to vLLM 0.24.0. Technical summary The flaw is missing input validation (CWE-20) in the Rust gRPC Generate and GenerateStream path, which accepts output_candidates.token_ids and passes them into SamplingParams.logprob_token_ids without the length cap of 128, vocabulary range checks, or logprobs consistency checks that the Python API enforces. A request with output_logprobs set to true and more than 128 candidate token IDs is accepted, reaches the V1 GPU logprob sampler, and raises a ValueError there, which EngineCore treats as a fatal error. The advisory lists the attack vector as network, attack complexity as high, no privileges or user interaction required, and availability as the only impact, with a base score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected versions are stated as 0.22.0 up to but not including 0.24.0, and the patched version is 0.24.0. The advisory does not state any workaround, any detection guidance, or whether the flaw has been exploited in the wild. Its suggested fix is to reject oversized or out-of-vocabulary candidate ID lists with INVALID_ARGUMENT before any engine request is submitted. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-6pgw-f3pv-4h8q Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.2	CVE-2026-116172	vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... vllm-project, Vllmvllm-project vllm, vLLM	NVD	Oct 25 14:16 UTC
CVE-2026-116172vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that allows remote attackers to bypass max_logprobs limits via... Executive summary A flaw in the Rust gRPC interface of vLLM versions from 0.22.0 before 0.24.0 lets a remote caller bypass the configured limit on logprob counts, which can crash the inference engine. The advisory rates it Moderate with a CVSS 3.1 base score of 5.9, and the fix is to upgrade to vLLM 0.24.0. Technical summary The vulnerability is improper input validation (CWE-20) with an unsigned-to-signed integer cast (CWE-190) in the Rust gRPC converter, which copies the CandidateTokens.top_n value into SamplingParams.logprobs or prompt_logprobs without checking the max_logprobs cap. Values such as 1000000 or 2147483648 (which wraps to a negative number) reach the V1 sampler's torch.topk path and can raise an error that the advisory says makes EngineCore fail. The attack requires network access to the Rust gRPC endpoint with no privileges or user interaction, and the advisory's impact is availability only (CVSS AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H in the NVD metrics). The fixed version is stated as 0.24.0, and the advisory says the patch is to validate top_n against max_logprobs and i32 range. No workaround is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/vllm-project/vllm/security/a…/GHSA-rwfw-xvg3-3937 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects vllm-project Vllm vllm-project vllm vLLM NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.7	CVE-2026-116171	SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and... siyuan-notesiyuan-note siyuan	NVD	Oct 25 14:16 UTC
CVE-2026-116171SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and... Executive summary SiYuan note-taking software on Windows, versions from 3.5.4 through 3.8.6 according to the advisory, can be tricked into copying its private configuration, including the API token and TLS private keys, into publicly reachable files. The advisory rates it High with a CVSS 3.1 base score of 7.5. The fix is to upgrade to v3.8.7. Technical summary The flaw is a path traversal (CWE-22) caused by an incomplete denylist (CWE-184) in util.IsSensitivePath, which does not normalize the Windows extended-length prefix \\?\. Prefixing a protected path with that prefix bypasses the check, and the POST /api/import/importStdMd endpoint then copies the workspace conf directory into data/assets/, which is served without authentication. The advisory's CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and it states that the affected versions are 3.5.4 to 3.8.6 with v3.8.7 as the patched version. The advisory does not state a workaround. It does not state whether the flaw has been exploited in the wild, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-6gmc-424x-xgpm Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note siyuan-note siyuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116170	SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116170SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op and type=3 query values Executive summary SiYuan versions before v3.8.7 contain a SQL injection flaw in the history search feature that can expose the contents of the history database. Only holders of an administrator API token can exploit it, and the advisory rates it Moderate with a CVSS score of 4.9. The recommended fix is to upgrade to v3.8.7. Technical summary The flaw is SQL injection (CWE-89) in the history search, where the op field and the query field used when type=3 are concatenated into SQL without escaping, and the resulting statement runs against history.db without a single-statement or read-only check. The advisory states the attack vector is network, complexity low, privileges high (admin token required), no user interaction, with high confidentiality impact and no integrity or availability impact. Affected versions are stated as <= 3.8.6 and the patched version as v3.8.7. The advisory lists remediation as escaping op and query and adding single-statement and read-only checks to the history query functions. No workaround is stated, and no CVE identifier is stated (the advisory says 'No known CVE'). Exploitation in the wild is not stated. Detection guidance beyond the proof of concept is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-4hjx-84f6-gr7c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.1	CVE-2026-116169	SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... siyuan-note, KaTeX, SiYuansiyuan-note siyuan, KaTeX, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116169SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script by placing javascript: URLs in math... Executive summary SiYuan, a note-taking application, from version 2.10.0 before 3.8.7 contains a stored cross-site scripting flaw. A user with edit permission can plant a math block that runs attacker script in the application when another user clicks a link in it. The advisory rates the severity as High and the fix is to update to version 3.8.7 or later. Technical summary The flaw is stored cross-site scripting (CWE-79) in math block rendering. KaTeX is run with trust set to true and its output is assigned via innerHTML without sanitization, so a \href, \url, or \includegraphics with a javascript: URL is preserved and executes when a reader clicks the rendered link. Preconditions are edit permission on a document and a victim clicking the link; the advisory notes no click means no execution. Affected versions are stated as 2.10.0 and later (before 3.8.7 per the advisory's range), and the patched version is listed as v3.8.7. No workaround is stated. Detection guidance is not stated, and no CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-hhvq-jqv9-pgjq Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note KaTeX SiYuan siyuan-note siyuan KaTeX SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116168	SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... siyuan-note, b3log, SiYuansiyuan-note siyuan, SiYuan, b3log siyuan-note	NVD	Oct 25 14:16 UTC
CVE-2026-116168SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relies on an incomplete sensitive-path blacklist that omits... Executive summary SiYuan, a self-hosted note-taking application, has a path traversal flaw in its MCP asset upload tool that lets an agent-facing caller copy sensitive files from the host, such as a home-directory .env file, into the workspace where they can be read back. The advisory rates it High. The advisory says the fix to be applied is version 3.8.7 and that the vendor's patch is incomplete, since the earlier sensitive-path blacklist omits some secret-bearing filenames. Technical summary The weakness is CWE-22 path traversal with information exposure (CWE-200): the MCP asset upload tool passes file paths through a sensitive-path blacklist (util.IsSensitivePath) that does not cover names such as .env, so a local file is copied into the workspace data/assets directory and served back over HTTP to authenticated sessions. The advisory states affected versions are 3.8.6 and earlier (<= 3.8.6) and the patched version is v3.8.7, but it describes the v3.8.7 fix as incomplete, and it does not state whether 3.8.7 itself fully resolves the issue. Preconditions include an API token for an agent or admin principal driving the MCP server and a file readable by the server process. The advisory's proof of concept was run against v3.8.6 in a Docker lab, and it reports the upload succeeded under the fixed build. No workarounds are stated. No detection guidance is stated. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-q768-4j87-gf3w Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note b3log SiYuan siyuan-note siyuan SiYuan b3log siyuan-note NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116167	SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116167SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to parameter to window.location.href... Executive summary SiYuan versions from 2.9.0 through 3.8.6 contain a cross-site scripting flaw on the unauthenticated /check-auth page. A victim who opens a crafted link and logs in on that page can have attacker script run inside the authenticated kernel session. The advisory rates it Moderate with a CVSS score of 6.8, and the fix is version 3.8.7. Technical summary The flaw is DOM-based cross-site scripting caused by the to query parameter on /check-auth being assigned to window.location.href without scheme validation, so a javascript: URI runs after a successful login. The attack requires a network-reachable kernel, a victim who opens a crafted link, and a valid access auth code entered by that victim (CVSS AV:N/AC:H/PR:N/UI:R). The advisory states affected versions as >= 2.9.0, <= 3.8.6 and the patched version as v3.8.7. No workaround is stated. Detection guidance is not stated, though the advisory gives a proof-of-concept URL pattern containing a javascript: value in the to parameter. The advisory also states that exploitation in the wild is not mentioned, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-fmj3-xc2f-6w4w Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.6	CVE-2026-116166	SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS siyuan-note, SiYuansiyuan-note siyuan, SiYuan	NVD	Oct 25 14:16 UTC
CVE-2026-116166SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS Executive summary SiYuan versions from 3.6.0 up to and including 3.8.6 have a flaw where an administrator setting meant to turn on encrypted HTTPS serving is accepted but not enforced, so the kernel also answers unencrypted HTTP on the same port. A network-adjacent attacker could read login details and session cookies, and the advisory rates the issue Moderate with a CVSS score of 6.8. The fix is to upgrade to version 3.8.7, which the advisory lists as the patched version. Technical summary The weakness is cleartext transmission of sensitive information (CWE-319). The networkServeTLS setting, changed through POST /api/system/setNetworkServeTLS, is persisted but not used to restrict the listener, so the kernel port serves plain HTTP with full API access alongside HTTPS. The session cookie also lacks the Secure attribute and HTTPS responses lack Strict-Transport-Security, which the advisory says compounds the exposure. Affected versions are stated as >= 3.6.0, <= 3.8.6, and the patched version is v3.8.7. The attack vector is Adjacent with high complexity and no privileges or user interaction required, and the CVSS vector is CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory does not state any workaround other than upgrading, and it does not state whether the flaw is exploited in the wild. The advisory lists No known CVE for this record. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/siyuan-note/siyuan/security/…/GHSA-hpj5-f7cj-vvwr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects siyuan-note SiYuan siyuan-note siyuan SiYuan NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.8	CVE-2026-116165	Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116165Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key... Executive summary A flaw in Parse Server, a backend framework, lets clients without the master key delete class schemas on MongoDB deployments. The advisory rates it High (CVSS v4 8.8) and says deleted schemas also remove class-level permissions and protected fields, which can expose or modify data. Technical summary This is a missing authorization flaw (CWE-862) in Parse Server on MongoDB deployments. A remote, unauthenticated client without the master key can delete the stored schema of any class through the REST API, removing field definitions, class-level permissions and protected fields; object ACLs still apply. The advisory lists affected versions as >= 9.0.0, < 9.10.4-alpha.4 and < 8.6.101, with patched versions 9.10.4-alpha.4 and 8.6.101. PostgreSQL deployments are stated to be unaffected. The vendor's workaround is to register a Cloud Code beforeDelete trigger for the class name _SCHEMA that rejects requests without the master key. The advisory states that upgrading does not restore already deleted schemas, so administrators should review and restore permissions, protected fields and field definitions. No CVE ID is assigned in the advisory, and no detection guidance or known exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-qmg9-m772-5rm7 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116164	Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116164Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal... Executive summary Parse Server, a Node.js backend framework, has a flaw that lets clients write objects with reserved internal field names. On MongoDB deployments this can make reads of affected objects fail for all users of that class, and any user can clear internal account lockout or password history fields on their own account. The advisory rates the issue Moderate and recommends upgrading to Parse Server 8.6.100 or 9.10.4-alpha.3, or applying a beforeSave Cloud Code trigger workaround. Technical summary The weakness is CWE-20, Improper Input Validation, where Parse Server does not reject reserved internal field names in client object writes. The attack is network based with low complexity and requires no privileges or user interaction, but the attacker must be allowed to create objects in a class, and the advisory notes the MongoDB-specific read failure. Affected versions are stated as >= 9.0.0 and < 9.10.4-alpha.3, and < 8.6.100, with patched versions 9.10.4-alpha.3 and 8.6.100. The documented workaround is registering a beforeSave Cloud Code trigger for every writable class, including _User, which discards reserved field names; existing bad fields must be removed directly in MongoDB. The advisory does not state any detection guidance, and it does not state whether the issue is exploited in the wild. CVSS v4 base score is shown as 6.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N. No CVE ID is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-gwrq-q25v-g8mr Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Critical	9.1	CVE-2026-116163	Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116163Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom... Executive summary A flaw in Parse Server, a server framework for building app backends, lets attackers bypass authentication when an app uses a custom authentication adapter built as a subclass of AuthAdapter. The advisory rates it Critical with a CVSS 9.1 score and says the fix is to upgrade to Parse Server 8.6.102 or 9.10.5-alpha.2, or to rework custom adapters as described in the workarounds. Technical summary The weakness is classified as CWE-287, Improper Authentication. Custom adapters that extend AuthAdapter never had their validateSetUp, validateLogin, and validateUpdate methods called, so the inherited default accepting any authData was used instead. The advisory states the attack is network-based with low complexity and no privileges or user interaction required, and that an attacker can sign up, link an identity, or log in as an existing user without valid credentials. Affected versions are stated as 9.0.0 up to but not including 9.10.5-alpha.2, and versions before 8.6.102; patched versions are 9.10.5-alpha.2 and 8.6.102. Workarounds are to implement all validation in an overridden validateAuthData method that does not rely on adapter instance state, or to define the adapter as a plain object. The advisory does not state any detection guidance or indicators of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-rq3w-5c6f-p7wr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.1	CVE-2026-116162	Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116162Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code Executive summary Parse Server versions before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 let a user with SMS multi-factor authentication enabled change restricted fields on their own account. The advisory rates the severity as Low, with a CVSS v4 score of 2.1. Technical summary The flaw is classified as CWE-269, Improper Privilege Management. When requesting an SMS MFA login verification code, Parse Server saved the entire login request with master privileges, so extra account fields in that request were persisted, bypassing write restrictions such as beforeSave triggers. Exploitation requires an account enrolled in SMS MFA and high privileges as listed in the CVSS vector, and it is limited to the requester's own account. Affected versions are stated as greater than or equal to 9.0.0 and less than 9.10.5-alpha.5, and less than 8.6.104; patched versions are 9.10.5-alpha.5 and 8.6.104. The advisory states there is no configuration workaround and recommends upgrading. No detection guidance is stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-9rh6-r4ph-367v Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.0	CVE-2026-116161	Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery parse-community, Parse Serverparse-community parse-server, Parse Server parse-server	NVD	Oct 25 14:16 UTC
CVE-2026-116161Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery Executive summary Parse Server, a Node.js backend package, has an information disclosure flaw in its LiveQuery feature. Subscriptions that use a $or query can receive another user's events, including session tokens, which could let an attacker act as another user. The advisory rates it Moderate and recommends upgrading to a patched version (9.10.5-alpha.4 or 8.6.103). Technical summary The flaw is CWE-200 (exposure of sensitive information to an unauthorized actor) in Parse Server's LiveQuery. The subscription hash omits query constraints placed next to a $or operator, including the server-added _Session owner filter and constraints added by beforeSubscribe triggers, so different clients can be grouped into one subscription and receive each other's events. The advisory lists network attack vector, low attack complexity, low privileges required, no user interaction, and a CVSS v4 vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, with an overall score of 6.0. Affected versions are >= 9.0.0 and < 9.10.5-alpha.4, and <= 8.6.102; patched versions are 9.10.5-alpha.4 and 8.6.103. Workarounds are to protect sensitive classes with ACL or class-level permissions, avoid $or in _Session subscriptions, and avoid $or where isolation depends on constraints beside it. The advisory does not state any detection guidance, and it lists no CVE ID. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/parse-community/parse-server…/GHSA-349r-988w-x3jp Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects parse-community Parse Server parse-community parse-server Parse Server parse-server NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116160	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116160ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a heap-based buffer overflow in the X11 animate operation when processing a crafted image. The advisory rates the severity as low, with a CVSS v3.1 base score of 3.3, and recommends upgrading to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a heap-based buffer overflow (heap buffer over-write) triggered when X11 animate processes a crafted image. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, so exploitation requires local access and user interaction, and the advisory describes only a low availability impact. Affected versions are below 7.1.2-33 and below 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, and it gives no detection guidance, exploitation-in-the-wild status, or CVE identifier (it says No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-6p6q-wfrv-ffhh Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116159	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116159ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision list) option, where allocated memory is not cleaned up... Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak in the -cdl (color decision list) option. The advisory rates it low severity, with a CVSS v3.1 base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is a missing release of allocated memory (CWE-401) in the handling of the -cdl option, which causes a memory leak. The attack vector is listed as local, with low attack complexity, no privileges required, and user interaction required, and the impact is stated as low availability only (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. No CVE ID is assigned in the advisory. Workarounds and detection guidance are not stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-c2qq-jqw7-q4mx Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.0	CVE-2026-116158	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116158ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing cleanup when an operation fails Executive summary A memory leak in the magick compare command of ImageMagick, a tool for editing and comparing images, affects versions before 7.1.2-33. The advisory rates it Low severity, with a CVSS score of 2.5, and the fix is to update to version 7.1.2-33. Technical summary The flaw is a memory leak (CWE-401, missing release of memory) caused by missing cleanup in magick compare when an operation fails. The advisory describes it as a local attack requiring high attack complexity and user interaction, with no privileges needed, and a CVSS v3.1 vector of AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. The impact is limited to availability (low). Affected versions are stated as before 7.1.2-33 and the patched version is 7.1.2-33. No CVE identifier is listed (the advisory says No known CVE). Workarounds are not stated, and no detection guidance or indication of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-m938-565c-h9qf Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116157	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties ImageMagickImageMagick, ImageMagick PerlMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116157ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when reading image properties Executive summary A memory leak in the PerlMagick interface of ImageMagick, a widely used image processing library, is rated Low severity by the advisory. The fix is to upgrade ImageMagick to version 7.1.2-33 or later, which the advisory names as the patched version. Technical summary The flaw is CWE-401, missing release of memory after effective lifetime, in five locations in PerlMagick that return values that are never freed when image properties are read. The advisory gives a CVSS v3.1 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L with a base score of 3.3, meaning local access and user interaction are required and the impact is limited to availability. Affected versions are stated as before 7.1.2-33 and the patched version is 7.1.2-33. The advisory does not state any workaround, whether the flaw is exploited in the wild, or any detection guidance. The advisory lists no CVE ID, though the page identifier is CVE-2026-116157. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-pj4h-g4pf-66v3 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick ImageMagick PerlMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116156	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116156ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set profile option is used Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory leak that occurs when the -set profile option is used. The advisory rates the issue as low severity, with a CVSS v3.1 base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is a memory leak (CWE-401, missing release of memory after effective lifetime) caused by a missing cleanup step when the -set profile option is used. The attack vector is local, attack complexity is low, no privileges are required, and user interaction is required; the impact is low availability only, with no confidentiality or integrity impact. Affected versions are listed as before 7.1.2-33 and before 6.9.13-58, and patched versions are 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, and it provides no detection guidance. No CVE ID is assigned in the advisory, and it does not state whether the issue is known to be exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-7r5g-p7ff-jgcp Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116155	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116155ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various decoders Executive summary A memory leak in ImageMagick, an image processing software package, can be triggered by a crafted XMP profile processed by various decoders. The advisory rates the severity as Moderate with a CVSS base score of 5.3. The fix is to update to 7.1.2-33 or 6.9.13-58, depending on the branch in use. Technical summary The flaw is a memory leak (CWE not stated; the advisory lists no CWEs) triggered when ImageMagick parses a crafted XMP profile in various decoders. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so the attack is remote and needs no privileges or user interaction, with only a low availability impact. Affected versions are below 7.1.2-33 and below 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround, whether the issue is exploited in the wild, or any detection guidance. No CVE identifier is listed in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-5jf2-9gcp-q234 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116154	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116154ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated memory is not released when parsing reaches the nesting... Executive summary ImageMagick, an image processing library, contains a memory leak in its XML parsing code that is triggered when parsing hits a nesting depth limit. The advisory rates the severity as Moderate with a CVSS base score of 5.3 and says the fix is to upgrade to patched versions 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a memory leak (CWE not stated; the advisory lists no CWEs) in ImageMagick XML parsing, where allocated memory is not released when parsing reaches the depth limit. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so it is remotely reachable without privileges or user interaction and affects availability only. Affected versions are before 6.9.13-58 and before 7.1.2-33; patched versions are 6.9.13-58 and 7.1.2-33. No workaround, detection guidance, or exploitation status is stated, and no CVE ID is listed (the advisory says No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-8ghq-p369-g395 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.0	CVE-2026-116153	ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116153ImageMagick before 7.1.2-33 contains a heap buffer overflow vulnerability on 32-bit systems that allows attackers to overwrite heap memory when convex-hull information is requested Executive summary ImageMagick builds for 32-bit systems before 7.1.2-33 contain a memory corruption flaw that can be triggered when convex-hull information is requested. The advisory rates it as low severity with a CVSS score of 2.5, and the vendor's fix is to update to version 7.1.2-33. No known CVE identifier is assigned in the advisory. Technical summary The flaw is a heap buffer over-write, classified under CWE-190 (Integer Overflow or Wraparound), that occurs when convex-hull information is requested on 32-bit systems. The advisory lists the attack vector as local, attack complexity as high, no privileges required, and user interaction required, with only low availability impact and no confidentiality or integrity impact. Affected versions are stated as less than 7.1.2-33 and the patched version is 7.1.2-33. Workarounds are not stated, and no exploitation in the wild or detection guidance is mentioned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-7438-vh5v-v52h Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116152	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116152ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated memory in a specific error path Executive summary ImageMagick versions before 7.1.2-33 contain a memory leak in the MAT image decoder that occurs in a specific error path. The advisory rates the issue as moderate, with a CVSS v3.1 base score of 5.3, and the fix is to update to version 7.1.2-33. Technical summary The weakness is CWE-401 (Missing Release of Memory after Effective Lifetime), a small leak triggered in an error path of the MAT decoder. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, so the advisory describes network exploitation with no privileges or user interaction and only low availability impact. Affected versions are stated as less than 7.1.2-33, and the patched version is 7.1.2-33. No workaround is stated, no CVE identifier is listed (it says No known CVE), and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-83w9-w85j-h9jc Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116151	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116151ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the JNG encoder that fails to release allocated memory when processing a crafted image Executive summary A memory leak in the JNG image encoder of ImageMagick affects versions before 6.9.13-58 and 7.x before 7.1.2-33. The advisory rates it low severity, with a CVSS v3.1 base score of 3.7, and recommends updating to the patched versions 6.9.13-58 or 7.1.2-33. Technical summary The flaw is classified as CWE-401, missing release of memory after effective lifetime, in the JNG encoder, triggered when processing a crafted image. The advisory gives the CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, so the attack is network-reachable with high complexity, no privileges, and no user interaction, and the impact is limited to availability. Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround. It does not provide detection guidance, exploitation status in the wild, or a CVE identifier (it states No known CVE). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-v9q4-cm37-q2jm Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	2.3	CVE-2026-116150	ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116150ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust memory by supplying a crafted image Executive summary ImageMagick versions before 7.1.2-33 contain a memory leak in the FPX image encoder that a crafted image can trigger, causing memory exhaustion. The advisory rates the issue Low severity with a CVSS 3.1 base score of 3.1. The recommended fix is to update to version 7.1.2-33 or later. Technical summary The flaw is a memory leak classified as CWE-401 (Missing Release of Memory after Effective Lifetime) in the FPX encoder of ImageMagick. The advisory states the attack vector is network, with high attack complexity, no privileges required, and required user interaction, and the impact is limited to low availability impact with no confidentiality or integrity impact. Affected versions are stated as less than 7.1.2-33 and the patched version is 7.1.2-33. No workaround is stated, and no detection guidance or evidence of exploitation in the wild is stated. No CVE identifier is listed in the advisory beyond the one provided by the requester. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-8w9c-hj38-8pf9 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	7.2	CVE-2026-116149	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116149ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images Executive summary ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a memory flaw that can be triggered by a crafted bzip2-compressed image. The advisory rates it High severity and says the fix is to upgrade to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is a stack-based buffer overflow (stack buffer over-write) when ImageMagick reads bzip2 compressed images, mapped to CWE-787 with related CWE-125 and CWE-573. The advisory lists the attack vector as network with low attack complexity, low privileges required, and no user interaction, based on the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H with a base score of 8.1. Affected versions are stated as before 7.1.2-33 and before 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory states no CVE ID is known. Workarounds are not stated, exploitation in the wild is not stated, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-pwpf-8799-94cj Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116148	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116148ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does not properly neutralize user-specified drawing options... Executive summary A code injection flaw in the MVG encoder of ImageMagick affects versions before 6.9.13-58 and 7.x before 7.1.2-33. The advisory rates it Low severity and recommends updating to the patched versions 6.9.13-58 or 7.1.2-33. Technical summary The advisory describes an injection vulnerability in the MVG encoder that does not properly neutralize user-specified drawing options, which can lead to code injection. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, meaning local access, no privileges, user interaction required, and low confidentiality impact. Affected versions are stated as before 7.1.2-33 and before 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory lists a CWE-79 cross-site scripting weakness, which appears inconsistent with the described flaw, and no CVE ID is assigned. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-qq8x-fq3x-43h4 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116147	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116147ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU decoder because the result of a memory allocation is not checked before use Executive summary ImageMagick, an image processing library, has a flaw in its DJVU image decoder that can cause it to crash. The advisory rates the severity as low, with a CVSS score of 3.7, and the vendor recommends upgrading to ImageMagick 7.1.2-33 or 6.9.13-58, which are the patched versions. Technical summary The flaw is a null pointer dereference (CWE-476) in the DJVU decoder, caused by using the result of a memory allocation without checking it first, so a failed allocation leads to a crash. The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning it is remotely reachable over the network with high complexity, no privileges or user interaction needed, and only low availability impact. Affected versions are listed as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance. No CVE identifier is listed (the advisory says 'No known CVE'), and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-v5f5-4v9x-p3f2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116146	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116146ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release allocated memory when processing a crafted MSL image Executive summary A memory leak in the MSL decoder of ImageMagick, an image processing package, can be triggered by a crafted MSL image. The advisory rates it Low, with a CVSS v3.1 base score of 3.7, and recommends upgrading to ImageMagick 7.1.2-33 or 6.9.13-58 or later. Technical summary The flaw is classified as CWE-401 (missing release of memory after effective lifetime) and CWE-400 (uncontrolled resource consumption). The vector is network-based with high attack complexity, no privileges, and no user interaction, and the advisory's vector shows only low availability impact with no confidentiality or integrity impact. Affected versions are listed as before 6.9.13-58 and before 7.1.2-33, with patched versions 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance, exploitation status, or CVE identifier (it lists 'No known CVE'). The advisory's text does not explain how the crafted MSL image must be delivered beyond being processed by the decoder. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-j657-rmv3-4m94 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	1.8	CVE-2026-116145	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116145ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for the policy bypass reported in GHSA-jjp4-3fwf-393j Executive summary ImageMagick, an image processing software package, has a security policy bypass caused by an incomplete fix for an earlier policy bypass. The advisory rates the severity as Low, with a CVSS v3 base score of 3.9. The vendor's recommendation is to upgrade to ImageMagick 7.1.2-32 or 6.9.13-58, depending on the branch in use. Technical summary The weakness is classified as CWE-693 (Protection Mechanism Failure) and results from an incomplete fix of GHSA-jjp4-3fwf-393j, which allowed a policy bypass. The CVSS v3.1 vector is AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L, meaning exploitation requires local access, high complexity, and high privileges. Affected versions are stated as before 6.9.13-58 and before 7.1.2-32, with patched versions 6.9.13-58 and 7.1.2-32. No workaround is stated in the advisory. No detection guidance is stated, and no CVE identifier is listed. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-4wfv-467j-fqh9 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required High User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116144	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116144ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead to a stack overflow Executive summary ImageMagick versions before 6.9.13-58 and before 7.1.2-33 contain a flaw that can crash the image processing software when it reads a specially crafted file. The advisory rates the severity as low, with a CVSS v3.1 base score of 3.3, and the vendor recommends upgrading to 7.1.2-33 or 6.9.13-58. Technical summary The flaw is uncontrolled recursion (CWE-674) in the MVG decoder, which can exhaust the program stack and cause a stack overflow. The advisory describes the attack vector as local, with low attack complexity, no privileges required, and user interaction required, and it says the impact is limited to low availability loss. Affected versions are listed as less than 7.1.2-33 and less than 6.9.13-58, with patched versions 7.1.2-33 and 6.9.13-58. The advisory does not state any workaround. It does not state whether exploitation has occurred in the wild, and it gives no detection guidance. No CVE assignment is listed in the advisory text, and the advisory is tagged GHSA-x258-xjqf-6j3f. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-x258-xjqf-6j3f Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116143	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116143ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS decoders that allows the security policy's list length limit on scene... Executive summary A policy bypass in ImageMagick's PS, PDF and XPS decoders lets the security policy's list length limit on scene selection be circumvented. The advisory rates it Low severity with a CVSS 3.1 base score of 3.3, and the fix is to update to a patched version. Technical summary The flaw is classified as CWE-770, allocation of resources without limits or throttling, and the advisory describes it as a policy bypass where a specific argument lets an attacker get around scene selection in the PS, PDF and XPS decoders. The CVSS v3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, so exploitation requires local access and low privileges with no user interaction, and the impact is limited to availability. Affected versions are below 7.1.2-33 and below 6.9.13-58, and patched versions are 7.1.2-33 and 6.9.13-58. The advisory does not state a workaround, and it does not state any detection guidance or whether the flaw is exploited in the wild. No CVE identifier is listed; the advisory says 'No known CVE'. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-fp46-842c-2v83 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116142	ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116142ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printing a minimum-bounding-box Executive summary A heap buffer over-read in ImageMagick lets an attacker read memory beyond what was allocated when a minimum-bounding-box is printed. The advisory rates it Low, with a CVSS 3.1 base score of 3.3, and says the fix is to upgrade ImageMagick to version 7.1.2-33 or later. Technical summary The flaw is classified as CWE-125, an out-of-bounds read, and is triggered when a crafted image causes a minimum-bounding-box to be printed. The CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, so exploitation requires local access and user interaction, and impact is limited to low confidentiality loss. Affected versions are stated as before 7.1.2-33, and the patched version is 7.1.2-33. The advisory does not state any workaround. It also does not give detection guidance or say whether the flaw is exploited in the wild. No CVE identifier is assigned in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-5222-mhv9-26rg Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116141	ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur... ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116141ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade image width and height limits because extent checks occur... Executive summary ImageMagick versions before 7.1.2-33 contain a policy bypass in the UHDR image decoder that lets attackers get around configured image width and height limits. The advisory rates it Moderate, with a CVSS v3.1 base score of 5.3, and the fix is to update to version 7.1.2-33. Technical summary The flaw is classified under CWE-400 and CWE-770: the width and height checks in the UHDR decoder run after decoding rather than before UHDR decoder.decode, so resource limits are not enforced in time. The advisory's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, meaning it is network-reachable with no privileges or user interaction and only low availability impact. Affected versions are stated as before 7.1.2-33, and the patched version is 7.1.2-33. No workaround is stated in the advisory. No CVE identifier is assigned in the advisory ('No known CVE'). Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-h3qx-937j-245g Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116140	ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run ImageMagickImageMagick	NVD	Oct 25 14:16 UTC
CVE-2026-116140ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an executable blocked in policy.xml to still run Executive summary ImageMagick versions before 6.9.13-58 and before 7.1.2-33 can be tricked into running an executable that the site's policy.xml file blocks. The advisory rates this as low severity with a CVSS base score of 3.3, and the fix is to update to 6.9.13-58 or 7.1.2-33. Technical summary The flaw is an incorrect authorization check (CWE-863) in how ImageMagick parses delegate invocations, which allows an executable blocked in policy.xml to still run. The attack vector is local, with low attack complexity, no privileges required, and user interaction required. The CVSS v3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. Affected versions are stated as before 6.9.13-58 and before 7.1.2-33, and patched versions are 6.9.13-58 and 7.1.2-33. The advisory does not state any workaround, and it gives no detection guidance. No CVE ID is assigned according to the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ImageMagick/ImageMagick/secu…/GHSA-528x-2384-jmxp Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ImageMagick ImageMagick NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Medium	5.1	CVE-2026-116139	WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()... WWBNWWBN AVideo	NVD	Oct 25 14:16 UTC
CVE-2026-116139WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScript because markDownToHTML()... Executive summary WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting flaw that lets a logged-in user who can post comments inject JavaScript into pages viewed by others. The advisory does not give a severity rating or CVSS score, and it does not state a fixed version or a vendor recommendation beyond the code change shown. Technical summary The flaw is stored cross-site scripting caused by the markDownToHTML() function, which renders user comment text. The attacker needs an authenticated account able to post comments, and the victim's browser executes the injected script when the comment is viewed. The advisory excerpt shows a code diff that replaces the previous Parsedown safe-mode handling with a custom class that allows only a and img tags, with href, target, src, class and style attributes filtered. The advisory does not state a fixed version number, a workaround, indicators of compromise, exploitation in the wild, or a CVSS score, and it does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/WWBN/AVideo/commit/f13587c59…9273021d29b869594559 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects WWBN WWBN AVideo NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	Low	1.9	CVE-2026-116053	A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1 dbclidbcli mycli	NVD	Oct 25 14:16 UTC
CVE-2026-116053A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1 Executive summary A weakness in the mycli database command-line tool, versions up to 2.29.4 and 2.30.1, could allow an attacker to run operating system commands. The advisory says a public exploit is available, and the vendor did not respond when contacted about the issue. Technical summary The flaw is an OS command injection weakness in the function source_special_command_is_safe in mycli/packages/special/source.py, within a component described as Whitelist. Exploitation requires a local attacker who can manipulate input to that function, and the advisory says the attack can be launched on the local host. A public exploit exists. The advisory does not state a fixed version, a workaround, a CVSS score, or any detection guidance. Defenders should check whether mycli is installed and which version is in use. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dbcli dbcli mycli NIST National Vulnerability DatabasePublished Oct 25, 2026 14:16 UTC Read the advisory
	High	8.1	CVE-2026-111497	Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder Microsoft, GoogleMicrosoft .NET, Google Brotli	Microsoft MSRC	Oct 25 14:00 UTC
CVE-2026-111497Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder Executive summary A buffer overflow in the Brotli decoder can let an unauthorized attacker elevate privileges over a network. The advisory does not state a severity rating or a CVSS score, and it does not name a fixed version or a vendor recommendation. Technical summary The flaw is described as a buffer overflow caused by an out-of-bounds write in .NET, the Brotli decoder component. The advisory states that an unauthorized attacker can exploit it over a network to elevate privileges. Affected and fixed version numbers are not stated. Required user interaction, authentication details, and exploitation status are not stated. No workaround or detection guidance is provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Google Microsoft .NET Google Brotli Microsoft Security Response CenterPublished Oct 25, 2026 14:00 UTC Read the advisory
	High	7.8	CVE-2026-114148	ASP.NET Core Elevation of Privilege Vulnerability MicrosoftMicrosoft ASP.NET Core	Microsoft MSRC	Oct 25 14:00 UTC
CVE-2026-114148ASP.NET Core Elevation of Privilege Vulnerability Executive summary An elevation of privilege flaw affects ASP.NET Core, a Microsoft web framework. The advisory says an authorized local attacker can use it to gain higher privileges. The advisory text provided does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is classed as incorrect default permissions in ASP.NET Core, which allows a local attacker who already holds some authorization to elevate privileges. The attack vector is described as local, with an authorized attacker as the precondition. Affected versions are not stated, and no fixed version is given. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C Affects Microsoft Microsoft ASP.NET Core Microsoft Security Response CenterPublished Oct 25, 2026 14:00 UTC Read the advisory
	Medium	5.3	CVE-2026-116052	A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8 LinkStackOrgLinkStackOrg LinkStack	NVD	Oct 25 13:16 UTC
CVE-2026-116052A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8 Executive summary A security flaw has been found in LinkStack, a web-based link management product from LinkStackOrg, affecting versions up to 4.8.8. The advisory describes it as a cross-site request forgery issue that can be exploited remotely. The advisory does not state a severity rating, and the vendor did not respond to early disclosure, so no vendor fix or recommendation is stated. Technical summary The flaw is classified as cross-site request forgery in an unspecified function of LinkStack. The advisory says remote exploitation is possible, but it does not describe the required user interaction or other preconditions. The affected versions are stated as up to 4.8.8. No fixed version is stated, no workaround is stated, no CVSS score is stated, and no detection guidance is stated. The vendor was contacted early but did not respond. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects LinkStackOrg LinkStackOrg LinkStack NIST National Vulnerability DatabasePublished Oct 25, 2026 13:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116137	adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like... cthackers, adm-zipcthackers adm-zip, adm-zip	NVD	Oct 25 12:16 UTC
CVE-2026-116137adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like... Executive summary The advisory says adm-zip through version 0.6.1, a JavaScript library for handling zip files in Node.js, contains a flaw that lets attackers get past its duplicate-entry check. The advisory text provided is cut off and does not state a severity rating or a fix for this issue. The vendor's recommended action is not stated in the text provided. Technical summary The flaw is a validation bypass: attackers can evade the duplicate-entry check in readEntries() by using canonically equivalent entry names. The advisory excerpt is truncated and does not give the attack vector details, required preconditions, or the full example. Affected versions are stated as through 0.6.1. A fixed version is not stated. A workaround is not stated. Detection guidance is not stated. A CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/cthackers/adm-zip Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects cthackers adm-zip cthackers adm-zip adm-zip NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.0	CVE-2026-116136	ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by... ProjectSendProjectSend	NVD	Oct 25 12:16 UTC
CVE-2026-116136ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by... Executive summary ProjectSend versions 2.0.0 through 2.7.1 contain a flaw that lets staff users share files without the authorization they should need. The advisory text provided is cut off and the rest of the description, along with any severity rating, is not stated. Technical summary The advisory describes an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization. The provided text is truncated after the words 'by...', so the exploitation method is not stated. The attack vector and preconditions beyond a staff user account are not stated. The advisory does not state a fixed version, a workaround, a CVSS score, or exploitation in the wild. No detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/projectsend/projectsend Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ProjectSend ProjectSend NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116073	Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via... leon-ai, Leonleon-ai leon, Leon	NVD	Oct 25 12:16 UTC
CVE-2026-116073Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via... Executive summary A path traversal flaw in Leon, an open-source personal AI assistant, lets attackers write files outside the models directory. The advisory text provided is truncated and mostly shows the Leon project's GitHub page, so the severity rating and the full details are not stated. The advisory does not state a vendor fix or recommended action beyond the commit reference. Technical summary The vulnerability is a path traversal in the getModelFileNameFromURL() function, which the advisory says allows attackers to write files outside the models directory. The advisory says Leon is affected before commit 50df142. The attack vector, required privileges, and user interaction are not stated. No fixed release version, workaround, CVSS score, or detection guidance is stated, and the advisory text is cut off before the rest of the description. The remainder of the text is repository page content, not vulnerability detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/leon-ai/leon Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Active CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects leon-ai Leon leon-ai leon Leon NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116072	Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the... Docile-Alligator, Infinity for RedditDocile-Alligator Infinity for Reddit, Infinity for Reddit	NVD	Oct 25 12:16 UTC
CVE-2026-116072Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the... Executive summary Infinity for Reddit, an Android Reddit client, is affected by a login cross-site request forgery flaw that can log a victim into an attacker-controlled account. The advisory text provided is truncated and does not state a severity rating or the vendor's recommended fix. Defenders should check the NVD entry and the project's release notes for those details. Technical summary The flaw is a login cross-site request forgery (CSRF) vulnerability in Infinity for Reddit through 8.3.4, which lets an attacker log victims into an account the attacker controls. The advisory text is cut off before it explains the root cause, the exact attack preconditions, or user interaction requirements. No fixed version is stated in the provided text, though the affected range ends at 8.3.4. No workaround, CVSS score, exploitation status, or detection guidance is stated. The rest of the text is repository boilerplate from the project's GitHub page and contains no further vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Docile-Alligator/Infinity-For-Reddit Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Docile-Alligator Infinity for Reddit Docile-Alligator Infinity for Reddit Infinity for Reddit NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.2	CVE-2026-116071	rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the... rotkirotki	NVD	Oct 25 12:16 UTC
CVE-2026-116071rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the... Executive summary The advisory describes a weakness in rotki, an open-source self-hosted portfolio manager, that affects versions before 1.44.2. An attacker could potentially brute-force encrypted backups because of how the premium sync key is derived. The advisory text provided is truncated and does not state a severity rating, and the vendor's recommendation is only partly visible, pointing to an update beyond the affected range. Technical summary The flaw is classified as weak key derivation: the premium sync key is described as a single unsalted SHA-256 hash, which makes offline brute-force of backups feasible. The advisory states that versions before 1.44.2 are affected, implying 1.44.2 is the fixed version. The attack vector, required privileges, and user interaction are not stated in the provided text. Workarounds are not stated. Detection guidance and exploitation status in the wild are not stated. The CVSS score is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/rotki/rotki Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects rotki rotki NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116070	Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite... dqzboy, Docker-Proxydqzboy Docker-Proxy, Docker-Proxy	NVD	Oct 25 12:16 UTC
CVE-2026-116070Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite... Executive summary The advisory says Docker-Proxy through 5.1.9 has a missing authentication flaw in the hubcmdui routes/config.js component that lets unauthenticated attackers read and overwrite configuration. The text provided is truncated and the advisory does not state a severity rating or a vendor fix. Defenders should check whether they run Docker-Proxy and restrict access to its admin interface until a fix or guidance is confirmed. Technical summary The flaw is classified as missing authentication (CWE-style access control weakness) in hubcmdui routes/config.js, allowing unauthenticated attackers to read and overwrite configuration. The attack vector and preconditions are not stated in the provided text, and the advisory text is cut off mid-sentence. Affected versions are given as through 5.1.9, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated. The remainder of the text is repository README content that describes deployment and default credentials, not the vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/dqzboy/Docker-Proxy Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects dqzboy Docker-Proxy dqzboy Docker-Proxy Docker-Proxy NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	6.9	CVE-2026-116069	NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by... Albert-Weasker, NiubiGEOAlbert-Weasker niubigeo, NiubiGEO	NVD	Oct 25 12:16 UTC
CVE-2026-116069NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by... Executive summary The advisory says NiubiGEO versions before 0.3.2 contain an unauthenticated server-side request forgery flaw, which lets remote attackers make the server fetch internal addresses. The advisory text is cut off, so its stated severity score and full impact are not stated. The advisory does not describe a vendor-recommended fix beyond implying that upgrading to version 0.3.2 or later addresses the issue. Technical summary The flaw is a server-side request forgery (SSRF) in NiubiGEO before 0.3.2, reachable without authentication by remote attackers. The advisory text is truncated, so the full attack preconditions, request parameters, and exploit details are not stated. The fixed version is stated as 0.3.2 (the advisory says 'before 0.3.2'). No CVSS score, workaround, mitigation, or detection guidance is stated, and whether the flaw is exploited in the wild is not stated. The remainder of the text is project README content and does not describe the vulnerability further. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Albert-Weasker/niubigeo Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Albert-Weasker NiubiGEO Albert-Weasker niubigeo NiubiGEO NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116068	Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying... DokployDokploy	NVD	Oct 25 12:16 UTC
CVE-2026-116068Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying... Executive summary Dokploy, a self-hosted platform for deploying applications and databases, has an authorization bypass flaw according to the advisory. The flaw lets owners or admins of one organization control other tenants' applications, and the advisory's text is cut off before it states a severity or the vendor's recommendation. Technical summary The advisory describes an authorization bypass in Dokploy through 0.30.10 that allows owners or admins of any organization to control other tenants' applications by supplying a value that is cut off in the text. The attack requires an authenticated account with owner or admin rights in some organization. The advisory text is incomplete and mostly consists of repository page content, so the exact request parameter, the fixed version, any workaround, any CVSS score, and any detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Dokploy/dokploy Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Dokploy Dokploy NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	8.8	CVE-2026-116067	Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read... ananthakumaran, Paisaananthakumaran paisa, Paisa	NVD	Oct 25 12:16 UTC
CVE-2026-116067Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read... Executive summary Paisa, a personal finance manager, has a path traversal flaw in versions before 0.7.8 that the advisory says lets unauthenticated attackers read files. The advisory text is truncated and does not state a severity rating. The advisory does not state a vendor recommendation, so the fixed version 0.7.8 is the only remediation target it mentions. Technical summary The flaw is a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers, which lets unauthenticated attackers read files. The advisory text is cut off, so the full impact, attack details, and any further consequences are not stated. Versions before 0.7.8 are affected, and 0.7.8 is the fixed version as stated. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ananthakumaran/paisa Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ananthakumaran Paisa ananthakumaran paisa Paisa NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	High	7.0	CVE-2026-116066	Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via... FirecrawlFirecrawl	NVD	Oct 25 12:16 UTC
CVE-2026-116066Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via... Executive summary The advisory says the Firecrawl web scraping and AI data service, before version 2.11.586, has a server-side request forgery flaw in its Playwright service proxy. The advisory text is cut off, so the full severity rating and vendor guidance are not stated here, and defenders should check the original NVD entry for the complete details. Technical summary The flaw is classified as server-side request forgery in the Playwright service SSRF proxy, which lets attackers bypass isInternalHost checks. The advisory text is truncated mid-sentence, so the exact bypass technique and attack preconditions are not stated. The affected versions are stated as all versions before 2.11.586. No workaround, CVSS score, exploitation status, or detection guidance is stated in the advisory text provided. The remaining text is repository page content and contains no additional vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/firecrawl/firecrawl Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Firecrawl Firecrawl NIST National Vulnerability DatabasePublished Oct 25, 2026 12:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116050	A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 09:16 UTC
CVE-2026-116050A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary A public registration page in the Employee Recruitment System, an open-source project by krupalshah, contains an SQL injection flaw that can be exploited without logging in. The advisory describes it as critical and says an attacker could read, and possibly change, the underlying database. The advisory does not state a vendor fix or patch, and notes the project is no longer maintained. Technical summary The flaw is SQL injection in source/registerform3.php, where POST parameters (post, resume, pemail, semail, setpassword) are concatenated directly into an INSERT statement via mysql_query without sanitisation or prepared statements. It requires no authentication or cookie, and the advisory demonstrates boolean-based and time-based blind techniques using SLEEP() with sqlmap against MySQL/MariaDB. The affected version is stated as V1.0 (master branch, no version tags), and the advisory references commit 922ff6d208278282e7c8e36d70d9ae356adec9fe as the upper bound. No fixed version is stated, and no vendor workaround is given beyond suggested repairs such as prepared statements, input validation, generic error handling, CSRF and rate limiting, and least-privilege database accounts. No CVSS score or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/61 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 09:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116049	A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 09:16 UTC
CVE-2026-116049A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary A SQL injection flaw has been reported in the krupalshah EmployeeRecruitmentSystem, an unauthenticated public registration form. An outside attacker could potentially read the underlying database, including records and passwords. The advisory does not state a severity score, and it does not say a fix is available; the advisory's suggested repair is to switch to prepared statements and validate inputs. Technical summary The advisory describes an SQL injection in source/registerform2.php, where eight POST parameters are concatenated directly into an INSERT statement via mysql_query without sanitisation or parameter binding. The endpoint requires no session or login, and the advisory describes boolean-based and time-based blind injection, with a SLEEP payload causing a measurable delay. The affected version is stated as up to 922ff6d208278282e7c8e36d70d9ae356adec9fe, with V1.0 on the master branch and no version tags; the advisory notes the project is no longer maintained by the original vendor. No fixed version is stated. No workaround is stated beyond the suggested repair of prepared statements, input validation, generic error handling, and reduced database permissions. Detection guidance is limited to the described boolean oracle (HTTP 302 versus 200) and response delays, and no CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/60 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 09:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116048	A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe krupalshahkrupalshah EmployeeRecruitmentSystem	NVD	Oct 25 08:16 UTC
CVE-2026-116048A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe Executive summary The advisory reports a pre-authentication SQL injection flaw in the EmployeeRecruitmentSystem project by krupalshah, affecting version V1.0 and the repository state up to commit 922ff6d208278282e7c8e36d70d9ae356adec9fe. An unauthenticated attacker could read or modify the underlying database through the public registration form. The advisory does not state a severity score, and it does not state any fixed version or vendor patch. Technical summary The vulnerability is an SQL injection (boolean-based and time-based blind) in source/registerform1.php, where nine POST parameters are concatenated directly into an INSERT statement built with mysql_query, without sanitisation or prepared statements. The endpoint requires no session or login, so the attack vector is remote and unauthenticated. The advisory describes a boolean oracle (HTTP 302 for a clean insert versus HTTP 200 with a Database error message for a broken value) and a SLEEP-based time delay, and it reports sqlmap enumeration of a MySQL/MariaDB database. The affected version is stated as V1.0 on the master branch with no version tags, and no fixed version is stated. The advisory suggests prepared statements, input validation, generic error handling, and reduced database privileges, but it does not state a workaround or vendor fix. The advisory does not state a CVSS score or any detection guidance beyond the described response behaviour, and it does not state whether the flaw is exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ubfbuz3/cve/issues/59 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects krupalshah krupalshah EmployeeRecruitmentSystem NIST National Vulnerability DatabasePublished Oct 25, 2026 08:16 UTC Read the advisory
	Low	2.1	CVE-2026-116047	A vulnerability has been found in Privoce Vocechat up to 0.9.121 PrivocePrivoce VoceChat	NVD	Oct 25 08:16 UTC
CVE-2026-116047A vulnerability has been found in Privoce Vocechat up to 0.9.121 Executive summary A cross-site scripting flaw in the VoceChat chat server, made by Privoce, lets an attacker run scripts in a logged-in user's browser by sending a crafted link. The advisory says a proof of concept captured a valid session token, which could allow account takeover without the victim's password. The advisory's CVSS v3.1 score is 8.7 (High), and the vendor's fix is not stated in the advisory, though it recommends removing unsafe HTML rendering and avoiding storing session tokens in localStorage. Technical summary The advisory describes a DOM-based cross-site scripting (CWE-79) in widget.html, where the welcome URL parameter is read client-side and inserted into the DOM without sanitization or encoding. Exploitation requires only that a logged-in victim open a crafted link, with no server round-trip needed, and the proof of concept stole the VOCECHAT_TOKEN and VOCECHAT_CURR_UID values from localStorage. The advisory gives CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N with a score of 8.7. Affected versions are stated only in the title as up to 0.9.121, and the advisory does not state a fixed version. The advisory does not state whether a workaround exists beyond recommended code changes and a Content-Security-Policy, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/H1ck1y/Vulnerabilities/blob/…n/Vocechat_DomXss.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Privoce Privoce VoceChat NIST National Vulnerability DatabasePublished Oct 25, 2026 08:16 UTC Read the advisory
	Medium	4.8	CVE-2026-116046	A flaw has been found in eventcatalog sdk up to 2.29.0 eventcatalogeventcatalog sdk	NVD	Oct 25 07:16 UTC
CVE-2026-116046A flaw has been found in eventcatalog sdk up to 2.29.0 Executive summary A flaw was found in the EventCatalog SDK, versions up to 2.29.0. The advisory describes a path containment issue that let custom doc reads, writes, and deletes reach files outside the catalog docs directory. The advisory text does not state a severity rating, and it shows a code change that fixes the issue. Technical summary The advisory describes a path traversal weakness in the custom doc functions of the EventCatalog SDK, where custom doc file paths were not confined to the catalog docs directory. The fix adds path validation that rejects null bytes, drive-letter and UNC paths, and paths that resolve outside the docs root, and it resolves symlinks so that links pointing outside the docs directory are not followed. The attack vector and required privileges are not stated, and the advisory does not state a CVSS score or whether exploitation occurred in the wild. The advisory text shows a fixed change set in a patch release but does not explicitly name the fixed version number, and it does not state any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/event-catalog/eventcatalog/c…92e88d8b4893f4c6d6ca Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects eventcatalog eventcatalog sdk NIST National Vulnerability DatabasePublished Oct 25, 2026 07:16 UTC Read the advisory
	Low	2.1	CVE-2026-116045	A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0 1999AZZAR1999AZZAR designer-mcp	NVD	Oct 25 07:16 UTC
CVE-2026-116045A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0 Executive summary The advisory says a vulnerability was detected in the designer-mcp server by 1999AZZAR, affecting versions up to 2.1.0. The text does not state how severe the flaw is or what the vendor recommends, and it gives no fixed version. Technical summary The advisory text is a copied GitHub repository page and does not describe the vulnerability class, attack vector, or preconditions. The only version information is 'up to 2.1.0', and no fixed version is stated. No CVSS score, workaround, mitigation, exploitation status, or detection guidance is stated. The page mentions a previously closed CWE-22 path traversal fix in get_reference (issue #14), but it does not link that fix to this advisory's vulnerability, so it should not be treated as the affected issue. Defenders should check the upstream project and the NVD entry for details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/1999AZZAR/designer-mcp Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects 1999AZZAR 1999AZZAR designer-mcp NIST National Vulnerability DatabasePublished Oct 25, 2026 07:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-94295	The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before... ChikkiliChikkili Google Pay India for Woocommerce	NVD	Oct 25 06:16 UTC
CVE-2026-94295The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before... Executive summary The Chikkili Google Pay India for WooCommerce WordPress plugin, through version 1.0.6, does not verify that payment notifications truly come from the payment provider. This flaw is rated medium severity with a CVSS score of 5.3 in the advisory, and no fixed version is stated, so the advisory gives no vendor fix to apply yet. Technical summary The flaw is a missing authorization issue, classified as CWE-862 and OWASP A5 Broken Access Control, in which the plugin accepts payment notifications without verifying they originated from the payment provider. The advisory states the affected version as through 1.0.6 and lists the status as No known fix, so no fixed version is stated. The advisory does not describe the required attacker position, exploitation in the wild, or any workaround. Detection guidance and vendor remediation steps are not stated. The CVSS score given is 5.3 (medium), and the publication date is listed as 2026-10-22. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/d6ee17a1-0db1-…10-8c96-96e98fb734ec Score No CVSS score published. Affects Chikkili Chikkili Google Pay India for Woocommerce NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Low	2.1	CVE-2026-116044	A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6 prasathmaniprasathmani TinyFileManager	NVD	Oct 25 06:16 UTC
CVE-2026-116044A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6 Executive summary A security flaw has been reported in TinyFileManager, a file management tool made by prasathmani, in versions up to 2.6. The advisory says the flaw allows unrestricted file upload, can be attacked remotely, and that a public exploit exists; the vendor did not respond to early disclosure, and no vendor fix or recommendation is stated. Technical summary The weakness is classified as unrestricted upload of a file, located in the Remote URL File Upload Module of tinyfilemanager.php, and the advisory states it can be triggered remotely. Affected versions are stated as up to 2.6, and no fixed version is stated. The advisory does not state any preconditions such as authentication requirements, nor any workaround. No detection guidance is stated. The exploit is described as publicly disclosed and usable. No CVSS score or exploitation-in-the-wild status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects prasathmani prasathmani TinyFileManager NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115251	The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and... DuplicatorDuplicator	NVD	Oct 25 06:16 UTC
CVE-2026-115251The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and... Executive summary The Duplicator WordPress plugin, before version 5.0.0, lets users who should not be allowed to install plugins run its one-click upgrade routine, which can lead to privilege escalation. The advisory rates the issue high severity with a CVSS score of 7.2. The fix is to upgrade Duplicator to version 5.0.0 or later. Technical summary The flaw is classified as privilege escalation (CWE-269, improper privilege management) because the one-click upgrade routine is not restricted to users allowed to install plugins. The advisory lists CVSS 7.2 (high) and maps it to OWASP A2 Broken Authentication and Session Management. The advisory does not state the precise attack vector, the exact privilege level required to exploit it, or whether it is being exploited in the wild. Affected versions are stated as before 5.0.0 and the fixed version is 5.0.0. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/c4512e96-6d96-…4e-90c0-ad784eb1c145 Score No CVSS score published. Affects Duplicator Duplicator NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115214	The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse... DatawizaDatawiza Proxy Auth Plugin	NVD	Oct 25 06:16 UTC
CVE-2026-115214The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse... Executive summary The Datawiza Proxy Auth Plugin WordPress plugin, versions before 1.1.1, can be abused to gain elevated privileges. The advisory rates the issue critical with a CVSS score of 9.8 and says the fix is to update to version 1.1.1. Technical summary The flaw is a privilege escalation issue (CWE-269, improper privilege management) in the plugin's handling of user-identity and role HTTP request headers. The plugin does not verify that these headers come from a trusted reverse proxy, so a request that supplies forged headers may be trusted as an authenticated user with a chosen role. Affected versions are stated as before 1.1.1, and the fixed version is 1.1.1. The advisory does not state specific workarounds, and it gives no detection guidance. Exploitation in the wild is not stated. The CVSS vector string is not stated beyond the 9.8 critical score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2c6c7d10-2281-…98-a0d6-769da5cce416 Score No CVSS score published. Affects Datawiza Datawiza Proxy Auth Plugin NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-115183	The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the... Qi Addons For ElementorQi Addons For Elementor qi-addons-for-elementor	NVD	Oct 25 06:16 UTC
CVE-2026-115183The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the... Executive summary The Qi Addons For Elementor WordPress plugin is affected by a content injection flaw in versions before 1.11.2. The advisory says the flaw is rated low severity (CVSS 2.4), and the fix is to update the plugin to version 1.11.2. Technical summary The flaw is a content injection issue (CWE-345 listed, OWASP A1: Injection) in the plugin's widget heading text handling. The plugin does not properly sanitise heading text after decoding HTML entities, which the advisory says allows users with an unspecified level of access to inject content. The advisory's truncated text does not clearly state the full required privilege level. The fixed version is 1.11.2, and affected versions are described as those before 1.11.2. The advisory does not state any workaround, and it does not give detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a9cd8675-25f3-…81-b768-4f20ef9208a8 Score No CVSS score published. Affects Qi Addons For Elementor Qi Addons For Elementor qi-addons-for-elementor NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114743	The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action,... instawpInstaWP Connect	NVD	Oct 25 06:16 UTC
CVE-2026-114743The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action,... Executive summary The InstaWP Connect WordPress plugin, versions before 0.1.4.2, is affected by a missing authorization flaw. The advisory rates it low severity (CVSS 3.1 low) and states that the fix is version 0.1.4.2. Technical summary The flaw is classified as CWE-862 (missing authorization) under OWASP A5 Broken Access Control. The plugin does not perform a capability check on its settings update action, so a caller lacking the required privilege may be able to change settings. The advisory states the affected versions as before 0.1.4.2 and the fixed version as 0.1.4.2. The attack vector and required privilege level are not explicitly stated beyond the classification as no authorisation, and the CVSS vector string is not given, only the score rating of low. No workaround and no detection guidance are stated in the advisory, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/b94671c5-c5b5-…8d-ac9c-af21c7cbc6a4 Score No CVSS score published. Affects instawp InstaWP Connect NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114742	The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114742The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to... Executive summary The WPVR WordPress plugin, which manages virtual tours, has a flaw that lets users with contributor-level access and above change virtual tours they do not own. The advisory rates the issue low severity with a CVSS score of 2.7 and says the fix is version 9.0.3. Technical summary The flaw is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level ownership checks when virtual tours are updated. An attacker needs an authenticated account with contributor-level access or higher, and the advisory does not describe any other preconditions. The plugin is fixed in version 9.0.3, and versions before 9.0.3 are affected. The advisory does not state any workaround or detection guidance, and it does not say whether the issue is exploited in the wild. The CVSS score given is 2.7 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/201b0ca5-366d-…6e-a92f-6962cd200bd7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114741	The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114741The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access... Executive summary The WPVR WordPress plugin, before version 9.0.3, lets users with contributor-level access read and change virtual tours they should not be able to reach. The advisory rates the issue low severity with a CVSS score of 3.8, and the fix is to update to version 9.0.3 or later. Technical summary This is an insecure direct object reference (IDOR, CWE-639) caused by missing object-level authorization checks when reading and updating virtual tours in the WPVR plugin. An attacker needs contributor-level access on the WordPress site. The advisory states the affected versions as before 9.0.3 and the fixed version as 9.0.3. The advisory does not state any workaround or detection guidance, and it does not state whether the flaw is being exploited in the wild. The CVSS score given is 3.8 (low), and the advisory does not give a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/bfa704b5-b934-…15-aa75-d50b28baedf7 Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114740	The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... WPVRWPVR	NVD	Oct 25 06:16 UTC
CVE-2026-114740The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and... Executive summary The WPVR WordPress plugin, versions before 9.1.3, contains a flaw that lets low-privileged users change site content they should not be able to change. The advisory rates it medium severity with a CVSS score of 4.9, and the fix is to update to version 9.1.3. Technical summary The flaw is a missing authorization check (CWE-862, broken access control) in the WPVR plugin's setup wizard, which does not correctly verify user capabilities when creating a tour. The advisory says users with the Contributor role and above can exploit it, which is the stated precondition. The fixed version is 9.1.3, and the affected range is versions before 9.1.3. The advisory does not state any workaround or mitigation, and it gives no detection guidance or information on exploitation in the wild. The text is truncated, so further details may be missing. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ac47bef6-b870-…ae-b9ad-ace83687280d Score No CVSS score published. Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111981	The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view)... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111981The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view)... Executive summary The GiveWP WordPress plugin, a donation management plugin, contains a flaw that lets users with donor-report view access change donor address information without authorization. The advisory rates the severity as low, with a CVSS score of 2.7, and the fix is version 4.19.0.1. Technical summary The flaw is a missing capability check (CWE-862, broken access control) in GiveWP's handling of donor address changes, so an authenticated user who holds donor-report view permission can modify donor addresses. The advisory describes the affected range as versions before 4.19.0.1 and the fixed version as 4.19.0.1. The CVSS score given is 2.7 (low). Attack vector details beyond the required donor-report view role, workarounds, and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/9fae25ff-51e6-…37-83d6-e752374dae57 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111980	The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111980The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to... Executive summary The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a custom fundraising role perform actions they should not be allowed to. The advisory rates it as medium severity with a CVSS score of 5.5. The fix is to update to version 4.19.0.1, which the advisory lists as the fixed version. Technical summary The flaw is an incorrect authorization issue (CWE-863) in which the plugin does not correctly determine which page a page-capability request applies to. Users with a custom fundraising role may be able to abuse this to gain access they should not have. The advisory states the fixed version is 4.19.0.1 and the affected versions are before 4.19.0.1. Attack vector and preconditions beyond the custom fundraising role are not stated. Workarounds are not stated. Detection guidance is not stated. The advisory text is truncated, so the full impact description is not available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7664c532-7a74-…de-8ae1-df4862067689 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111979	The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute,... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111979The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute,... Executive summary A cross-site scripting flaw in the GiveWP WordPress donation plugin lets a malicious user inject script through a donation form template setting. The advisory rates it medium severity, with a CVSS score of 6.8, and says the fix is in version 4.19.0.1. Technical summary The flaw is a stored or reflected cross-site scripting (CWE-79) caused by GiveWP not properly sanitising and escaping one donation form template setting before it is output inside an HTML attribute. The advisory lists the affected versions as before 4.19.0.1 and the fixed version as 4.19.0.1. The attack vector, required privileges, and user interaction are not stated in the text provided. No workaround is stated. No detection guidance is stated. The advisory text is truncated and the remaining unrelated entries in the listing describe other plugins. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/59b1b0ff-fbfb-…b8-883e-94b5f2cee5a4 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111978	The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111978The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role... Executive summary The GiveWP WordPress plugin, before version 4.19.0.1, has a flaw that lets users with a high-privilege custom role read files they should not be able to access. The advisory rates it medium severity with a CVSS score of 6.0, and it says the issue is fixed in version 4.19.0.1. Technical summary The flaw is a path traversal weakness (CWE-22, classified as TRAVERSAL) in which the plugin does not properly validate a user-supplied filename before reading it from disk. The attacker must hold a high-privilege custom role, so authentication is required. The advisory states the fix is in version 4.19.0.1 and that the affected versions are before 4.19.0.1. No workaround is stated, and no detection guidance is stated. The advisory also lists several unrelated plugin advisories with dates and titles, which are not clearly tied to this CVE, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ab77a13e-491e-…a9-a50d-839a8ad341aa Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-111976	The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing... GiveWPGiveWP	NVD	Oct 25 06:16 UTC
CVE-2026-111976The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing... Executive summary The GiveWP WordPress plugin is affected by a flaw that can expose sensitive information on public donation form pages. The advisory rates it medium severity with a CVSS score of 5.3, and the fix is to update to version 4.19.0.1. Technical summary The flaw is classified as sensitive data disclosure (CWE-200). The GiveWP plugin does not perform any status or capability check when rendering a donation form on a public front-end route, which allows information exposure to unauthenticated visitors; the advisory text is truncated, so the full impact is not stated. The advisory says the plugin is fixed in version 4.19.0.1 and that earlier versions are affected (before 4.19.0.1). The advisory does not state a workaround, whether exploitation in the wild has been observed, or any detection guidance. The listed related titles refer to other plugins and are not part of this GiveWP flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/f304401f-886c-…06-9629-d8f7a7146b78 Score No CVSS score published. Affects GiveWP GiveWP NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-110285	The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing... WP Stripe CheckoutWP Stripe Checkout wp-stripe-checkout	NVD	Oct 25 06:16 UTC
CVE-2026-110285The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing... Executive summary The WP Stripe Checkout WordPress plugin contains a flaw that lets an attacker bypass authentication for Stripe webhook requests. The advisory rates it medium severity with a CVSS score of 5.3 and says it is fixed in version 1.2.2.62. Technical summary The flaw is classified as an authentication bypass (CWE-287) in which the plugin does not verify the Stripe webhook signature when no signing secret is configured, which the advisory says is the default state. The attack vector is network-based, and the advisory indicates the attacker can gain access without authentication, but the exact impact beyond that is cut off in the text. Affected versions are stated as before 1.2.2.62, and the fixed version is 1.2.2.62. No workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/0f32d471-2806-…71-9a82-87895ef903ae Score No CVSS score published. Affects WP Stripe Checkout WP Stripe Checkout wp-stripe-checkout NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	Unknown	n/a	CVE-2025-15705	The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web... supsysticsupsystic Contact Form by Supsystic	NVD	Oct 25 06:16 UTC
CVE-2025-15705The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web... Executive summary The Contact Form by Supsystic WordPress plugin is affected by a cross-site scripting flaw that lets users with access to the form editor inject malicious web content. The advisory rates it low severity with a CVSS score of 3.5. The fix is to update the plugin to version 1.8.0 or later. Technical summary The flaw is a stored cross-site scripting (XSS, CWE-79) caused by the plugin not sanitising and escaping a form name. An attacker needs access to the form editor, so the precondition is an authenticated user with that privilege. The advisory states the plugin is affected before version 1.8.0 and fixed in 1.8.0. The advisory does not state a workaround, and it does not give detection guidance. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7b592632-614d-…92-8372-a38e667e547b Score No CVSS score published. Affects supsystic supsystic Contact Form by Supsystic NIST National Vulnerability DatabasePublished Oct 25, 2026 06:16 UTC Read the advisory
	High	n/a	CVE-2026-109618	CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Palo Alto Networks, PHPPalo Alto Networks PAN-OS, PHP, Palo Alto Networks Panorama, Palo Alto Networks VM-Series firewalls	Palo Alto Networks	Oct 25 05:25 UTC
CVE-2026-109618CVE-2026-109619CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products Executive summary Palo Alto Networks says two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect its PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The advisory rates the issue HIGH with a CVSS 4.0 base score of 8.7 and says Palo Alto Networks is not aware of any malicious exploitation. The vendor recommends applying the listed threat signatures and restricting management interface access now, and installing fixed PAN-OS releases as they become available, with several listed for late October 2026. Technical summary The flaws are classified as CWE-754 (improper check for unusual or exceptional conditions), and the advisory describes remote code execution through longjmp() handling of out-of-memory and fatal errors in PHP. The advisory states the attack vector is network, attack complexity is low, no privileges or user interaction are required, and the impact is high availability on the product. Affected PAN-OS versions are listed as below 12.2.4-h1, 12.1.4-h13, 12.1.7-h11, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1, 11.1.4-h38, 11.1.6-h40, 11.1.7-h12, 11.1.10-h36, 11.1.13-h16, 11.1.16-h4, 10.2.7-h39, 10.2.10-h42, 10.2.13-h27, 10.2.16-h12 and 10.2.18-h13. The advisory says the issue strictly affects the management web interface (HTTPS web UI and XML API), and affects a dataplane interface only if a management profile is attached. Workarounds include restricting management access to trusted internal addresses or a jump box, enabling listed Threat IDs and content versions, and routing management traffic through a data plane port. The advisory does not state a verified detection method beyond the Threat IDs and points to a Unit 42 article for more detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Palo Alto Networks PA-Series firewalls Summarized from security.paloaltonetworks.com/CVE-2026-109618 Score No CVSS score published. Affects Palo Alto Networks PHP Palo Alto Networks PAN-OS PHP Palo Alto Networks Panorama Palo Alto Networks VM-Series firewalls Palo Alto Networks Product SecurityPublished Oct 25, 2026 05:25 UTC Read the advisory
	Low	2.9	CVE-2026-116007	A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 YunaiV, zhijiantianya, YunaiV / zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro, YunaiV / zhijiantianya ruoyi-vue-pro	NVD	Oct 25 04:17 UTC
CVE-2026-116007A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 Executive summary The advisory reports that the YunaiV ruoyi-vue-pro (Yudao) project, up to version 2026.09, lets an unauthenticated attacker guess SMS verification codes without any attempt limit, which can lead to takeover of an account such as the built-in administrator. The advisory rates it Critical with a CVSS 3.1 score of 9.8, as stated by the reporter. The advisory states no fixed version exists as of 2026-09-21, and its remediation advice is to add failed-attempt counting and lockout to code verification. Technical summary The weakness is improper restriction of excessive authentication attempts (CWE-307, CWE-799, CWE-287) in the SMS verification code check, which keeps no failed-attempt counter, lockout, or rate limit. The attack needs only network access to the backend API and the target's mobile number, with no authentication and no user interaction; the advisory states the built-in admin's mobile number is published in the seed SQL. The advisory reports that POST /admin-api/system/auth/sms-login and POST /admin-api/system/auth/reset-password both accept a correct code, and that the login scene (scene=21) needs no CAPTCHA. Affected branches are listed as master, master-jdk17, and master-jdk25, with verified version master-jdk17 @ 7cab3a7; the fixed version is stated as none as of 2026-09-21. A workaround is not stated beyond the remediation suggestions, and no detection guidance is given beyond the advisory's suggestion to alert on abnormal verification volume per mobile and IP. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/63e3a697e…ffd41c1cbfdbb1fcd5b4 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV zhijiantianya YunaiV / zhijiantianya YunaiV ruoyi-vue-pro zhijiantianya ruoyi-vue-pro YunaiV / zhijiantianya ruoyi-vue-pro NIST National Vulnerability DatabasePublished Oct 25, 2026 04:17 UTC Read the advisory
	Medium	5.5	CVE-2026-116006	A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 YunaiV, zhijiantianyaYunaiV ruoyi-vue-pro, zhijiantianya ruoyi-vue-pro	NVD	Oct 25 04:17 UTC
CVE-2026-116006A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09 Executive summary A vulnerability was reported in the ruoyi-vue-pro project from YunaiV and zhijiantianya, affecting versions up to 2026.09. The advisory says an attacker can log in as any account whose mobile number they know, including the built-in administrator, without a password or verification. The advisory does not state a vendor recommendation or a fix; it says no fixed version was available as of 2026-10-21. Technical summary The weakness is a predictable SMS verification code (CWE-1188, CWE-798, CWE-640) caused by begin-code and end-code both being set to 9999 in the base application.yaml, so every SMS login code is 9999. An unauthenticated attacker calls send-sms-code with scene 21 and then sms-login with code 9999 to receive a full access token, with no CAPTCHA or user interaction required. The advisory gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with score 9.1. Affected branches are master, master-jdk17 and master-jdk25, and the fixed version is stated as none as of 2026-10-21. No workaround beyond overriding the begin-code and end-code values is explicitly stated as a vendor recommendation, and no exploitation in the wild or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/Fulucky0-yuri/1ad8a1f16…7cb85c498473753a8636 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV zhijiantianya YunaiV ruoyi-vue-pro zhijiantianya ruoyi-vue-pro NIST National Vulnerability DatabasePublished Oct 25, 2026 04:17 UTC Read the advisory
	Low	2.0	CVE-2026-116004	A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0 onyx-dot-apponyx-dot-app Onyx	NVD	Oct 25 03:16 UTC
CVE-2026-116004A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0 Executive summary A security vulnerability has been reported in Onyx, an open source AI platform from onyx-dot-app, in versions up to 5.0.0. The advisory text provided is mostly repository page content and does not describe the flaw, its severity, or a vendor fix. Defenders should check the original NVD entry and vendor channels for details and remediation guidance. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It names affected versions as up to 5.0.0 but does not state a fixed version, workaround, CVSS score, exploitation status, or detection guidance. The text provided is largely GitHub repository page content describing Onyx features and deployment modes. Teams running Onyx 5.0.0 or earlier should consult the NVD record and the upstream project for the specific flaw details and patched release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/onyx-dot-app/onyx Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects onyx-dot-app onyx-dot-app Onyx NIST National Vulnerability DatabasePublished Oct 25, 2026 03:16 UTC Read the advisory
	Medium	5.5	CVE-2026-116000	A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1 ZylonZylon PrivateGPT	NVD	Oct 25 03:16 UTC
CVE-2026-116000A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1 Executive summary A path traversal flaw has been reported in Zylon PrivateGPT versions 1.0.0 and 1.0.1. An attacker who can call the asynchronous ingestion API could read local files on the server and then query the language model to retrieve their contents. The advisory does not state a severity rating, and it does not describe a vendor-issued fix or recommended action beyond the issue's closure as not planned. Technical summary The flaw is an arbitrary file read caused by path traversal, where the /v1/artifacts/ingest/async endpoint accepts a UriArtifact value that points to a local file such as file:///etc/passwd. The reporter states that UriArtifact lacks a field validator, so the existing URI validation is bypassed, and that the raw path reaches the Celery worker, where functions in utils.py open and read the file. The reporter describes the attack as requiring only a POST request to the endpoint, with the file contents then retrievable through LLM queries. The advisory does not state the authentication requirements, the CVSS score, or a fixed version. It reports the affected version as the latest main branch in the reporter's environment, not a specific release, and it gives no workaround or detection guidance. The issue was closed as not planned on Jul 5, 2026. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/zylon-ai/private-gpt/issues/2269 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Zylon Zylon PrivateGPT NIST National Vulnerability DatabasePublished Oct 25, 2026 03:16 UTC Read the advisory
	Medium	6.9	CVE-2026-115999	A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 mansi-kmansi-k Restaurant_IMS	NVD	Oct 25 02:16 UTC
CVE-2026-115999A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694 Executive summary A SQL injection flaw has been reported in mansi-k Restaurant_IMS, an open-source restaurant inventory management application, at a specific commit. The advisory does not state a severity score, and the vendor did not respond to early disclosure contact, so no fix is available from the vendor. Technical summary The flaw is a SQL injection in the mysqli_connect function of lsmodal.php, triggered by manipulating the login_id and epsw arguments. The advisory says remote exploitation is possible. Affected versions are not stated beyond the commit identifier d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694, because the project uses a rolling release model. No fixed version, workaround, CVSS score, or detection guidance is stated, and the vendor did not respond to disclosure. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects mansi-k mansi-k Restaurant_IMS NIST National Vulnerability DatabasePublished Oct 25, 2026 02:16 UTC Read the advisory
	Low	2.1	CVE-2026-115997	A flaw has been found in pig-mesh pig up to 4.1.0 pig-meshpig-mesh pig	NVD	Oct 25 00:16 UTC
CVE-2026-115997A flaw has been found in pig-mesh pig up to 4.1.0 Executive summary The advisory describes a flaw in pig-mesh pig, an open-source Java development platform, in versions up to 4.1.0. The text provided is mostly repository content and does not state the impact or severity of the flaw, and it gives no vendor recommendation. Technical summary The advisory is a brief NVD-style notice that a flaw exists in pig-mesh pig up to 4.1.0, but the excerpt is cut off before the vulnerability description. The vulnerability class, attack vector, and preconditions are not stated. No CVSS score, exploitation status, or fixed version is stated. The repository text mentions Pig version 4.1.2 as a dependency and core framework version, but it does not say this is a fixed release. No workaround or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/pig-mesh/pig Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects pig-mesh pig-mesh pig NIST National Vulnerability DatabasePublished Oct 25, 2026 00:16 UTC Read the advisory
	Medium	6.3	CVE-2026-115996	A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1 Unitree RoboticsUnitree Robotics Unitree Go2	NVD	Oct 24 23:16 UTC
CVE-2026-115996A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1 Executive summary A vulnerability in the Unitree Go2 robot dog's chat component, affecting versions up to 1.1.13, 1.1.14.1, and 1.1.15.1, allows improper certificate validation. The advisory does not state a severity score, and it does not state a fix or recommended action from the vendor beyond confirming the issue was previously reported internally. Technical summary The flaw is improper certificate validation (CWE-295) in the WebSocketClient.connect function of websocket.py in the chat_go component, so the client does not properly verify the server's TLS certificate. The advisory says the attack may be initiated remotely, with high attack complexity and difficult exploitability. Affected versions are stated as up to 1.1.13/1.1.14.1/1.1.15.1, and a fixed version is not stated. A workaround is not stated, and detection guidance is not stated. The vendor quote references an internal ticket and submission number but gives no remediation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Unitree Robotics Unitree Robotics Unitree Go2 NIST National Vulnerability DatabasePublished Oct 24, 2026 23:16 UTC Read the advisory
	Critical	9.4	CVE-2026-115995	A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4 Unitree RoboticsUnitree Robotics Unitree Go2	NVD	Oct 24 23:16 UTC
CVE-2026-115995A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4 Executive summary Unitree Robotics' Unitree Go2 robot, in versions up to 1.1.11.4, contains a vulnerability that can be exploited remotely. The advisory does not state a severity score, but it recommends upgrading to version 1.1.11.5 to resolve the issue. Technical summary The flaw is an OS command injection (CWE-78) in the set_volume function of gpt_thread.py in the chat_go component, triggered by manipulating the Value argument. The advisory says the attack can be launched remotely. The advisory does not state the specific preconditions, authentication requirements, or whether exploitation has occurred in the wild. The fixed version is 1.1.11.5, and the advisory says upgrading the affected component is sufficient. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Unitree Robotics Unitree Robotics Unitree Go2 NIST National Vulnerability DatabasePublished Oct 24, 2026 23:16 UTC Read the advisory
	Low	2.1	CVE-2026-115982	A vulnerability was detected in phpIPAM up to 1.8.3 phpipamphpipam	NVD	Oct 24 22:16 UTC
CVE-2026-115982A vulnerability was detected in phpIPAM up to 1.8.3 Executive summary A reflected cross-site scripting flaw affects phpIPAM versions up to and including 1.8.3. An attacker can craft a link that runs malicious scripts in the browser of a logged-in user who opens it, which could lead to session hijacking or unauthorized actions. The advisory states the maintainer confirmed a fix will be included in the next release, and no fixed version is stated. Technical summary The flaw is reflected cross-site scripting in app/tools/racks/show-rack-popup.php, where the deviceid parameter is passed to create_rack_link() and placed unescaped into an img src attribute. strip_tags() removes HTML tags but leaves double quotes and event handlers, so a crafted link can break out of the attribute and run JavaScript when a victim visits it. The advisory says an admin login is needed to reach the Racks feature by default, and the CVSS 3.1 base score of 4.2 (Medium) is given with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The suggested mitigation is validating deviceid with is_numeric() and escaping the output with escape_input(). A fixed version number is not stated, and no workaround or detection guidance beyond the proof of concept is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/a7f3b2eea71d30ad7ccf65e1d47e502f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects phpipam phpipam NIST National Vulnerability DatabasePublished Oct 24, 2026 22:16 UTC Read the advisory
	Low	1.9	CVE-2026-115981	A security vulnerability has been detected in phpIPAM up to 1.8.3 phpipamphpipam	NVD	Oct 24 22:16 UTC
CVE-2026-115981A security vulnerability has been detected in phpIPAM up to 1.8.3 Executive summary A reflected cross-site scripting flaw affects phpIPAM versions 1.7.4 through 1.8.3 when run on PHP 7.x. An attacker who tricks a user into opening a crafted link could run scripts in that user's browser session, which could lead to session hijacking or unauthorized actions. The advisory gives the CVSS base score as 4.2 (Medium), and it does not state a vendor fix or workaround. Technical summary The flaw is reflected cross-site scripting in upgrade/index.php, where REQUEST_URI is printed into the HTML response without proper output encoding. The bug comes from a misplaced print inside the escape_input call, so the unescaped string is output before escaping runs, and the file also lacks the functions/functions.php include. The attack requires a victim to visit a crafted link, and the advisory states the CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. The advisory says the issue affects phpIPAM 1.7.4 to 1.8.3 on PHP 7.x, and it says install/index.php was fixed in 1.7.4 (commit 181a12e), but it does not state a fixed version for upgrade/index.php. Workarounds and detection guidance are not stated, though the reporter suggests inverting the function nesting so escape_input() runs before print. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/KHr00t/f9351510717a5dac4797920fe532fe1e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects phpipam phpipam NIST National Vulnerability DatabasePublished Oct 24, 2026 22:16 UTC Read the advisory
	None	n/a	cisco-sa-emudhra-info-ScS22A1r	Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities CiscoCisco IOS XR Software, Cisco Secure Firepower Management Center (FMC) Software, Cisco ThousandEyes Enterprise Agent, Cisco Duo Access Gateway, Cisco Duo Agentic Authorization Connector, Cisco Duo Network Gateway, Cisco Meraki Dashboard, Cisco Meraki MV Smart Camera Firmware, Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure	Cisco PSIRT	Oct 24 20:55 UTC
cisco-sa-emudhra-info-ScS22A1rCisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities Executive summary Cisco says eight intermediate certificates from the certificate authority eMudhra have weak private keys that can be brute-forced within seconds, so attackers could issue fraudulent TLS and code signing certificates. Cisco is still investigating its product line, and the advisory names a limited set of Cisco products as impacted, with some fixes or cloud remediation under way. Cisco recommends reviewing the vulnerable products table and applying the listed upgrades or remediation steps. Technical summary The flaw is a cryptographic key weakness: the private keys for eight eMudhra intermediate certificates were broken by an error in their April 2025 Key Generation Ceremony, so anyone can brute-force them, and the eight certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025. The advisory says the issue lets holders of these keys issue fraudulent TLS certificates for any domain and sign malicious code, and it states that a public announcement exists but that Cisco PSIRT is not aware of malicious use. The advisory lists target release dates and upgrade versions for some products, including Duo Access Gateway 3.2.0, Duo Network Gateway 3.4.1, Duo Agentic Authorization Connector 1.0.1, IOS XR Software 26.4.1 (target Nov 30, 2026), and Ultra Cloud Core - Subscriber Microservices Infrastructure 2026.04.1 (Nov 2026), but it does not give fixed versions for every product. The header states no workarounds are available, and the advisory says any workarounds will be documented in the Vulnerable Products section. Secure Firepower Management Center has a Cisco TechZone article for configuring a TLS policy to block known eMudhra certificate issuers. Detection guidance beyond that is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…mudhra-info-ScS22A1r Score No CVSS score published. Affects Cisco Cisco IOS XR Software Cisco Secure Firepower Management Center (FMC) Software Cisco ThousandEyes Enterprise Agent Cisco Duo Access Gateway Cisco Duo Agentic Authorization Connector Cisco Duo Network Gateway Cisco Meraki Dashboard Cisco Meraki MV Smart Camera Firmware Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Cisco Product Security Incident Response TeamPublished Oct 24, 2026 20:55 UTC Read the advisory
	Medium	6.9	CVE-2026-115973	A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 19:17 UTC
CVE-2026-115973A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3 Executive summary A weakness in the password recovery feature of FaveoSuite Faveo Helpdesk version 2.0.3 has been disclosed. The advisory does not state how severe the issue is or what fix is available, and it notes that the vendor was contacted early about the disclosure. Technical summary The advisory describes a weak password recovery flaw in ForgotPasswordController::sendResetLinkEmail and PasswordController::reset in app/Http/Controllers/Auth/ForgotPasswordController.php in Faveo Helpdesk 2.0.3. The advisory says the attack may be initiated remotely. It does not state the vulnerability class in detail, any preconditions, a CVSS score, a fixed version, a workaround, or whether exploitation has been observed. It also gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 19:17 UTC Read the advisory
	Critical	9.1	CVE-2026-114820	Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) Oracle CorporationOracle Corporation Oracle Java SE, Oracle Corporation Oracle GraalVM for JDK, Oracle Corporation Oracle GraalVM Enterprise Edition	NVD	Oct 24 19:17 UTC
CVE-2026-114820Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE) Executive summary A flaw in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition could let an unauthenticated attacker over the network access or change critical data. The advisory rates it 9.1 out of 10 under CVSS 3.1, which is critical severity. The advisory does not describe a fix or update recommendation in the text provided, so defenders should check the vendor's advisory for patch guidance. Technical summary The advisory describes a vulnerability in the JSSE (Java Secure Socket Extension) component that can be exploited through APIs, for example via a web service that supplies data to those APIs, and across multiple protocols over the network. No authentication or user interaction is required, and the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with a base score of 9.1. Affected versions are listed as Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and Oracle GraalVM Enterprise Edition 21.3.20.0.2. The advisory also notes Java deployments such as sandboxed Web Start applications and applets that run untrusted code are affected. Fixed versions, workarounds, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affects Oracle Corporation Oracle Corporation Oracle Java SE Oracle Corporation Oracle GraalVM for JDK Oracle Corporation Oracle GraalVM Enterprise Edition NIST National Vulnerability DatabasePublished Oct 24, 2026 19:17 UTC Read the advisory
	Medium	6.9	CVE-2026-115972	A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 faveosuitefaveosuite faveo-helpdesk	NVD	Oct 24 18:16 UTC
CVE-2026-115972A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3 Executive summary A flaw has been found in FaveoSuite Faveo Helpdesk versions up to 2.0.3. The advisory says it lets someone change the status of helpdesk items without the proper authorization checks, and it can be attacked remotely. The advisory does not state a severity score or a vendor fix. Technical summary The weakness is missing authorization (CWE-type access control flaw) in the UnAuthController functions changeStatus, close, open, and resolve in app/Http/Controllers/Client/helpdesk/UnAuthController.php. An attacker can manipulate the id and status arguments to change ticket state remotely. The advisory says the vendor was contacted early about the disclosure. Affected versions are stated as up to 2.0.3. A fixed version is not stated, no workaround is stated, no detection guidance is stated, and whether the flaw is exploited in the wild is not stated. No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects faveosuite faveosuite faveo-helpdesk NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115971	A vulnerability was found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 18:16 UTC
CVE-2026-115971A vulnerability was found in Travisun Opptrix 0.4.0 Executive summary A denial of service flaw was reported in Travisun Opptrix version 0.4.0, which can be triggered remotely and for which a public exploit exists. The project has been taken offline and deprecated, and the advisory states that the flaw only affects products no longer supported by the maintainer. Technical summary The advisory describes a denial of service issue in the Buffer.concat function within the preParsing handler for the /api/channels/webhook/ file in Travisun Opptrix 0.4.0. The attack can be launched remotely, and the advisory says a public exploit exists. The vulnerability class is given only as denial of service; the specific weakness type (such as CWE) is not stated. The maintainer says a fix was pushed to a private GitHub repository, but no fixed version number is stated, and no workaround, CVSS score, or detection guidance is stated. The advisory states the project is deprecated and taken offline, so no supported patched release is indicated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115970	A vulnerability has been found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 18:16 UTC
CVE-2026-115970A vulnerability has been found in Travisun Opptrix 0.4.0 Executive summary A code injection flaw has been publicly reported in Travisun Opptrix version 0.4.0, and the exploit is public and may be used. The project has been taken offline and deprecated by its maintainer, and the advisory says the flaw only affects products no longer supported by the maintainer. Technical summary The advisory describes a code injection vulnerability in the Import Endpoint at the /api/system-update/import path of Travisun Opptrix 0.4.0, which can be triggered remotely. The advisory does not state the specific weakness identifier, authentication requirements, or the exact payload needed for exploitation. The maintainer states the issue was a design flaw that was fixed only in a private GitHub repository before the project went private, but no fixed version number is stated. No workaround, vendor patch version, CVSS score, or detection guidance is stated in the advisory. Because the project is deprecated and offline, the advisory recommends no specific remediation step beyond noting that it is no longer supported. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 18:16 UTC Read the advisory
	Medium	5.5	CVE-2026-115969	A flaw has been found in Travisun Opptrix 0.4.0 TravisunTravisun Opptrix	NVD	Oct 24 16:16 UTC
CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0 Executive summary A command injection flaw has been reported in Travisun Opptrix version 0.4.0, a scheduling application. The advisory says the exploit has been published and may be used, and that the project is now offline and deprecated. The advisory states that only products no longer supported by the maintainer are affected. Technical summary The flaw is a command injection issue in an unknown function of the /api/auth/setup file within the Schedule API component of Travisun Opptrix 0.4.0. The advisory says it can be started remotely and that a public exploit has been published. The maintainer states that the underlying design flaw was fixed in the GitHub repository before that repository went private, but no fixed version number is stated. No workarounds, CVSS score, detection guidance, or affected version range beyond 0.4.0 are stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Travisun Travisun Opptrix NIST National Vulnerability DatabasePublished Oct 24, 2026 16:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115933	Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for GitroomHQGitroomHQ postiz-app	NVD	Oct 24 15:17 UTC
CVE-2026-115933Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for Executive summary A flaw in the Postiz social media scheduling app (GitroomHQ postiz-app, versions 2.15.0 and later) lets any registered user forge trusted tokens and take over other users' accounts and organizations. The advisory rates it Critical with a CVSS v3.1 score of 9.9. The vendor's fix is to update to version 2.25.3, and until then the advisory recommends blocking the extension-refresh route and disabling self-registration, which reduce but do not remove the risk. Technical summary The root cause is that Postiz signs session, invitation and password reset tokens with one shared secret and no marker of their purpose, and a browser-extension credential refresh route signs request-controlled data and stores it where the user can read it back (CWE-290, CWE-345, CWE-915). An attacker needs only an ordinary self-registered account, with network access and no user interaction. Affected versions are stated as 2.15.0 and later, and the fix is in 2.25.3 (commit a5affe62). The advisory gives workarounds: block POST /integrations/extension-refresh at the reverse proxy, which does not close the team invitation route, and set DISABLE_REGISTRATION=true. Specific detection guidance is not stated. Whether the instance must reach api2.skool.com is stated as a configuration condition, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-YT2HMH Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects GitroomHQ GitroomHQ postiz-app NIST National Vulnerability DatabasePublished Oct 24, 2026 15:17 UTC Read the advisory
	Critical	9.4	CVE-2026-115557	Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured Python, GoPython CPython, Go, Go crypto/x509	NVD	Oct 24 15:17 UTC
CVE-2026-115557Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured Executive summary The advisory covers a Go security fix that blocks trust in a small set of intermediate certificates from a specific Certificate Authority, delivered in Go 1.27.3 and Go 1.26.10. The Go team says it highly recommends immediately upgrading to these releases. The advisory does not state how severe the issue is. Technical summary The fix is in crypto/x509 and is described as a mitigation for security concerns with a specific Certificate Authority. Verify now filters out certificate chains that contain a small set of named intermediate certificates, so they are not returned to the caller. The advisory is tagged CVE-2026-111943 and references Go issue 82345. The attack vector, preconditions, and exploitation status are not stated. The affected version range is not stated, and no CVSS score is given. No workaround or detection guidance is stated beyond upgrading to Go 1.27.3 or Go 1.26.10. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from openwall.com/lists/oss-security/2026/10/20/29 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Python Go Python CPython Go Go crypto/x509 NIST National Vulnerability DatabasePublished Oct 24, 2026 15:17 UTC Read the advisory
	High	7.2	CVE-2026-114704	Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Christoph Vielgrader, PatchstackChristoph Vielgrader Relevanssi, Patchstack Relevanssi	NVD	Oct 24 14:16 UTC
CVE-2026-114704Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. Executive summary A deserialization flaw in the Relevanssi WordPress plugin, versions through 4.28.4, lets attackers inject PHP objects. Patchstack rates it as medium priority with a CVSS severity of 7.2 and says it is expected to be exploited. The vendor-side recommendation is to update the plugin to version 4.28.5 or later. Technical summary The weakness is classified as PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The advisory states the required privilege is Editor, so an attacker needs an account with that role. Affected versions are listed as n/a through 4.28.4 by NVD and as 4.28.4 and earlier by Patchstack, and the patched version is 4.28.5. Patchstack has issued a mitigation rule that blocks attacks until the update is applied. The advisory does not state a workaround beyond the mitigation rule, and it does not give specific detection guidance or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects Christoph Vielgrader Patchstack Christoph Vielgrader Relevanssi Patchstack Relevanssi NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-114629	Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body... Web::SimpleWeb::Simple	NVD	Oct 24 14:16 UTC
CVE-2026-114629Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body... Executive summary Web::Simple versions before 0.035 for Perl have a flaw in how they handle urlencoded request bodies. The advisory states the flaw lets a request make the software allocate a buffer sized by the Content-Length header, and the advisory does not state a severity rating. Technical summary The weakness is an allocation based on an attacker-controlled Content-Length header for urlencoded request bodies, a resource exhaustion issue; the advisory does not name a specific CWE or CVSS score. The attack vector is a crafted HTTP POST, and the advisory does not state any further preconditions. The advisory says versions before 0.035 are affected; the fixed version is stated as 0.035 by the phrase 'versions before 0.035'. The patch reads urlencoded bodies in chunks, adds a configurable $Web::Dispatch::ParamParser::MAX_BODY_SIZE defaulting to 8 MiB, and croaks on oversized Content-Length values. The advisory does not state a workaround beyond the advice to validate Content-Length before dispatch, and it provides no detection guidance or information on exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/p5sagit/Web-Simple/commit/7e…fe6dc2679af695.patch Score No CVSS score published. Affects Web::Simple Web::Simple NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114192	Missing Authorization vulnerability in Magepeople inc Magepeople inc.Magepeople inc. WpEvently	NVD	Oct 24 14:16 UTC
CVE-2026-114192Missing Authorization vulnerability in Magepeople inc Executive summary A missing authorization flaw in the WpEvently WordPress plugin, made by Magepeople inc, lets users reach functions they should not be able to use. The advisory rates it CVSS 6.5 but says it is low priority and unlikely to be exploited. The vendor recommends updating the plugin to version 5.7.9 or later. Technical summary The weakness is classed as Broken Access Control (OWASP A1) in WpEvently plugin versions up to and including 5.7.8. The required privilege is listed as Unauthenticated, and the advisory does not describe the specific attack steps or endpoints. The patched version is 5.7.9, and the advisory recommends updating to that version or later, with hosting providers or developers as a fallback if updating is not possible. No workarounds are stated beyond updating, and no detection guidance, indicators of compromise, or evidence of exploitation in the wild is stated. The advisory gives CVSS 6.5 but does not provide a full CVSS vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Magepeople inc.Magepeople inc. WpEvently NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	High	7.5	CVE-2026-114191	Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access... Knit PayKnit Pay UPI QR Code Payment Gateway for WooCommerce	NVD	Oct 24 14:16 UTC
CVE-2026-114191Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access... Executive summary A broken access control flaw in the UPI QR Code Payment Gateway for WooCommerce WordPress plugin, made by Knit Pay, lets people without logging in reach functions they should not use. The advisory rates it 7.5 CVSS and says it is expected to be exploited, and it recommends updating the plugin to version 1.7.0 or later. Technical summary The flaw is classified as Broken Access Control (missing authorization, OWASP A1) in the plugin's functions. The required privilege is stated as unauthenticated, so no account is needed. Vulnerable versions are stated as 1.6.3 and earlier (<= 1.6.3), and the patched version is 1.7.0. The advisory recommends updating to 1.7.0 or later. No workaround is given beyond updating, and Patchstack notes that no mitigation rule can be assigned for this flaw. The advisory does not state detection guidance, indicators of compromise, or whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Knit Pay Knit Pay UPI QR Code Payment Gateway for WooCommerce NIST National Vulnerability DatabasePublished Oct 24, 2026 14:16 UTC Read the advisory
	Critical	9.6	CVE-2026-115932	When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory GitroomHQ, PostizGitroomHQ postiz-app, Postiz	NVD	Oct 24 13:16 UTC
CVE-2026-115932When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory Executive summary A path traversal flaw in Postiz (GitroomHQ postiz-app) lets any registered user read arbitrary files on the server and have them sent to a Discord server the user controls, when the Discord provider is enabled. The advisory rates it Critical with a CVSS v3.1 score of 9.6, and the vendor's fix is to upgrade to version 2.25.3 or later. Until then, the advisory recommends setting DISABLE_REGISTRATION to true, which reduces exposure but does not close the issue. Technical summary The flaw is classified as CWE-22 (path traversal) and CWE-74 (injection). When a post is published, a media path that is not a web address is treated as a local file without checking that it lies inside the upload directory, so an authenticated user with an ordinary account can have the publishing worker read arbitrary files and deliver them as attachments. The affected range is given as 2.23.0 or later (≥ 2.23.0), and the fixed version is 2.25.3. The main route requires DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET and DISCORD_BOT_TOKEN_ID to be set, and the validation-time route requires a Dribbble, TikTok or Pinterest provider; the advisory states that the worker runs as root in the shipped container. Mitigations are to set DISABLE_REGISTRATION=true and leave the Discord provider credentials unset, though the advisory says these only reduce reach. The advisory does not state any detection guidance, and the publicly referenced fix is commit 12db9bd. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-E9AHFV Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affects GitroomHQ Postiz GitroomHQ postiz-app Postiz NIST National Vulnerability DatabasePublished Oct 24, 2026 13:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116020	BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments... BookStackApp, BookStackBookStackApp BookStack, BookStack	NVD	Oct 24 12:16 UTC
CVE-2026-116020BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments... Executive summary BookStack, a documentation and wiki platform, has an authorization flaw that lets logged-in users reach attachments on other users' unpublished draft pages. The advisory does not state a severity score, but it notes that attackers can download, rename, relink, or replace these files. The fix is to upgrade BookStack to version 26.09.2 or later. Technical summary The flaw is an incorrect authorization issue (CWE-like access control failure) in the AttachmentController. An authenticated user who holds attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files attached to another user's draft pages. The advisory states affected versions as BookStack before 26.09.2 and the fixed version as 26.09.2. A CVSS score, workaround, detection guidance, and confirmation of in-the-wild exploitation are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects BookStackApp BookStack BookStackApp BookStack BookStack NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116019	Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with... getgrav, Gravgetgrav grav, Grav	NVD	Oct 24 12:16 UTC
CVE-2026-116019Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-@ directives with... Executive summary The advisory says Grav CMS versions from 2.0.15 before 2.2.13 contain a flaw that lets users with page editing rights run arbitrary public static methods through blueprint directives. The text does not state a severity score. The advisory text does not state a vendor recommendation beyond the fix version shown in the description, so upgrading to 2.2.13 or later is the implied remedy. Technical summary The flaw is an allowlist bypass in Grav's handling of data-@ blueprint directives, which lets a page editor invoke arbitrary public static methods by relocating directives. The advisory excerpt is a source code listing of Blueprint.php with comments describing a fix, and it shows the allowlist and provenance checks that address the issue. The attack precondition is page editor access, and the excerpt does not state a CVSS score, exploitation status, or detection guidance. The affected range is stated as 2.0.15 before 2.2.13, and the fixed version is 2.2.13 as written in the description. Workarounds are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/getgrav/grav/blob/2.2.12/sys…n/Data/Blueprint.php Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects getgrav Grav getgrav grav Grav NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116018	ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read... ONEARMYONEARMY community-platform	NVD	Oct 24 12:16 UTC
CVE-2026-116018ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read... Executive summary ONEARMY community-platform versions before 2.165.2 contain a flaw that lets any logged-in user mark other users' notifications as read. The advisory does not state a severity rating or a score. The fix is to upgrade to version 2.165.2 or later. Technical summary The flaw is an insecure direct object reference (broken object-level authorization) in the notification read endpoint. The advisory says an authenticated user can change other users' notifications, and the code excerpt shows the update filters only on the notification ID with no check that the notification belongs to the calling user. Attack requires a valid authenticated session and knowledge or enumeration of notification IDs. The fixed version is stated as 2.165.2 (affected: before 2.165.2). The excerpt is from v2.163.2. Workarounds are not stated. Detection guidance is not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ONEARMY/community-platform/b…s.$id.read.ts#L6-L22 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects ONEARMY ONEARMY community-platform NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116017	Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows... xinnan-tech, Xiaozhixinnan-tech xiaozhi-esp32-server, Xiaozhi-esp32-server	NVD	Oct 24 12:16 UTC
CVE-2026-116017Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows... From the advisory Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects xinnan-tech Xiaozhi xinnan-tech xiaozhi-esp32-server Xiaozhi-esp32-server NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	7.1	CVE-2026-116016	yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a... YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud	NVD	Oct 24 12:16 UTC
CVE-2026-116016yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a... Executive summary The advisory describes an authorization bypass in yudao-cloud through 2026.09 that lets authenticated users get around row-level data scope restrictions. The advisory excerpt does not state a severity rating, and it does not state what the vendor recommends. Technical summary The flaw is an authorization bypass (improper enforcement of row-level data scope) in yudao-cloud through 2026.09, reachable by any authenticated user. The excerpt shows that DataPermissionRpcWebFilter reads a request header and, when it equals false, runs the request chain inside DataPermissionUtils.executeIgnore, which appears to skip data permission checks; the advisory text itself does not explicitly link the header to the bypass, so this is inferred from the code shown. Affected versions are stated only as through 2026.09, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated in the excerpt. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/d322…bFilter.java#L21-L36 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV yudao-cloud YunaiV yudao-cloud yudao-cloud NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116015	yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'... YunaiV, yudao-cloudYunaiV yudao-cloud, yudao-cloud	NVD	Oct 24 12:16 UTC
CVE-2026-116015yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members'... Executive summary The yudao-cloud platform through 2026.09 has a flaw in its mall trade module that lets a logged-in member read other members' data. The advisory is truncated and does not state a severity rating. It does not state a fix or vendor recommendation. Technical summary The flaw is an insecure direct object reference (broken object-level authorization) in the mall trade module. An authenticated member can read other members' records. The attached code excerpt shows the AppAfterSaleLogController /trade/after-sale-log/list endpoint, which takes an afterSaleId parameter and returns logs for that ID without any visible ownership check in the excerpt. Affected versions are stated only as through 2026.09, and no fixed version is stated. No CVSS score, workaround, or detection guidance is stated. Exploitation status is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/YunaiV/yudao-cloud/blob/5933…troller.java#L33-L40 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects YunaiV yudao-cloud YunaiV yudao-cloud yudao-cloud NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Critical	9.2	CVE-2026-116014	open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions open62541open62541	NVD	Oct 24 12:16 UTC
CVE-2026-116014open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions Executive summary An integer overflow in the open62541 OPC UA library affects versions 1.5.0 before 1.5.7 when it processes large custom structure definitions. The advisory describes the flaw as wrapping a 16-bit memory size field, but it does not state the severity or any CVSS score. The advisory does not say what the vendor recommends, though the affected version range implies that upgrading to 1.5.7 or later addresses it. Technical summary The flaw is an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field when a large custom structure definition is processed. The advisory does not state the attack vector, the preconditions for exploitation, or whether authentication is needed. The affected range is 1.5.0 before 1.5.7, and the fixed version is 1.5.7. The advisory does not state any workaround or detection guidance, and it does not state whether exploitation has been observed in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open62541/open62541/blob/v1.…es_definition.c#L274 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects open62541 open62541 NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	6.3	CVE-2026-116013	OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... openrestyopenresty lua-resty-dns	NVD	Oct 24 12:16 UTC
CVE-2026-116013OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths... Executive summary The advisory describes an input validation flaw in the OpenResty lua-resty-dns library, which fails to check DNS resource record lengths in its parsing functions. The text provided does not state how severe the flaw is or what fixed version is recommended beyond saying the library is affected before 0.24. Defenders should check whether they use lua-resty-dns and plan to upgrade to a release that includes the fix. Technical summary The flaw is an improper input validation issue in parse_section() and _decode_name(), which fail to check resource record lengths when parsing DNS responses. The advisory states the affected versions as before 0.24, but the file excerpt shows _VERSION as 0.22 and the page header refers to v0.23, and no fixed version is explicitly stated beyond the 0.24 boundary. The attack vector, required preconditions, exploitation status, CVSS score, workarounds, and detection guidance are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/openresty/lua-resty-dns/blob…solver.lua#L396-L442 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects openresty openresty lua-resty-dns NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Low	2.0	CVE-2026-116012	Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in... NationalSecurityAgency, GhidraNationalSecurityAgency ghidra, Ghidra	NVD	Oct 24 12:16 UTC
CVE-2026-116012Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in... Executive summary The advisory says Ghidra versions before 12.2 contain a numeric truncation flaw in its packed-data decoder, in the marshal.cc file. The advisory text does not state how severe the flaw is, and it does not give a CVSS score or describe any fix beyond the version boundary. Technical summary The flaw is described as a numeric truncation bug in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc, where 64-bit string lengths are stored in a narrower integer. The provided text shows the code, where readInteger returns a uint8 but skipAttribute and skipAttributeRemaining store the result in a uint4 length variable, which could cause incorrect skipping of data. The advisory text is cut off before its full description, so the attack vector, required preconditions, and exploitation status are not stated. The affected range is stated as before 12.2, but a fixed version number, workaround, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/NationalSecurityAgency/ghidr…marshal.cc#L641-L671 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects NationalSecurityAgency Ghidra NationalSecurityAgency ghidra Ghidra NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116011	Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply... CrowCpp, CrowCrowCpp Crow, Crow	NVD	Oct 24 12:16 UTC
CVE-2026-116011Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply... Executive summary The advisory says Crow versions before 1.3.4 contain an uncontrolled recursion flaw in the crow::json::load() function that lets a remote, unauthenticated attacker crash the server by sending deeply nested JSON. The text provided is truncated and does not state a severity score. The advisory does not state a vendor recommendation beyond the fixed version 1.3.4 in the description. Technical summary The flaw is classified as uncontrolled recursion in crow::json::load(), triggered by sending deeply nested JSON to a server, which can exhaust the stack and crash the process. The attack requires only remote, unauthenticated access as described. The affected range is stated as before 1.3.4, so 1.3.4 is the fixed version named. The source code excerpt shows a max_depth constant of 10000 in the parser, but the advisory does not explicitly state that this check is the fix or explain its effect. No workaround, CVSS score, exploitation status, or detection guidance is stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/CrowCpp/Crow/blob/v1.3.3/include/crow/json.h#L878 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects CrowCpp Crow CrowCpp Crow Crow NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116010	RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by... francoisjacquet, RosarioSISfrancoisjacquet RosarioSIS, RosarioSIS	NVD	Oct 24 12:16 UTC
CVE-2026-116010RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by... Executive summary RosarioSIS versions before 12.9.1 contain a missing authorization flaw that lets logged-in teachers write records for students who are not in their course period. The advisory's text describes the issue as a fix to an insecure direct object reference in several attendance, referral, eligibility, and grade pages. Severity rating, exploitation status, and the vendor's formal recommendation are not stated beyond the fix shipped in version 12.9.1. Technical summary The weakness is a missing authorization check (insecure direct object reference, tracked as security fix #377) that allows an authenticated teacher to submit student IDs outside their own course period. The fix in TakeAttendance.php, MakeReferral.php, EnterEligibility.php and InputFinalGrades.php checks submitted student IDs against the schedule table for the current school year, school, and course period before writing. The advisory states that RosarioSIS before 12.9.1 is affected and that the fix is in 12.9.1, but it does not give a CVSS score, CWE identifier, or exploitation status. Workarounds and detection guidance are not stated. Admins can confirm exposure by checking whether their installation is at 12.9.1 or later. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gitlab.com/francoisjacquet/rosariosis/-…1bc969c7aea6626bab66 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects francoisjacquet RosarioSIS francoisjacquet RosarioSIS RosarioSIS NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.7	CVE-2026-116009	Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the... owen2345, Camaleon CMSowen2345 Camaleon CMS, Camaleon CMS	NVD	Oct 24 12:16 UTC
CVE-2026-116009Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the... Executive summary Camaleon CMS versions before 2.9.3 let a low-privileged user with only the media permission write arbitrary files to the server, which the advisory says can lead to running code on the server. The advisory states the CVSS 4.0 score is 8.7 (High). The advisory does not state a fixed version beyond the 'before 2.9.3' wording in the CVE description, and it does not describe a vendor-issued workaround. Technical summary The flaw is a path traversal in the media crop_url feature, where the file name taken from params[:name] is cleaned for the file name part but not the folder part, so ../ sequences can write files outside the upload folder. The data:// URL scheme passes the host-only IP validation, letting a user write attacker-supplied base64 content to disk, including an ERB template into the theme views folder that Camaleon renders when the page is viewed. Attack requires an authenticated user with only the media permission (PR:L, AT:N, UI:N per the CVSS vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). The advisory states the version tested was Camaleon CMS v2.9.2 (commit c11e297a) and the CVE text says before 2.9.3. The advisory does not state an official fixed version, vendor workaround, or evidence of exploitation in the wild. Detection guidance is not stated beyond the proof-of-concept request details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gist.github.com/lukmanazri/b7e76a1ddc84dc977800013c53f671b5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects owen2345 Camaleon CMS owen2345 Camaleon CMS Camaleon CMS NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	5.3	CVE-2026-116008	DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without... Bottelet, DaybydayCRMBottelet DaybydayCRM, DaybydayCRM	NVD	Oct 24 12:16 UTC
CVE-2026-116008DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without... Executive summary DaybydayCRM through version 2.2.1 has a missing authorization flaw that lets any logged-in user reassign projects they should not control. The advisory describes the issue as a missing authorization check but does not state a severity rating or a score. The advisory does not state a fixed version or a vendor recommendation. Technical summary The flaw is a missing authorization check (CWE-style access control weakness) in the updateAssign() method of ProjectsController. Per the code shown, updateAssign() loads a project by external ID and sets user_assigned_id from the request without calling any permission check such as the can() checks used in other methods, so any authenticated user can reassign projects. The attack requires only a valid authenticated account. Affected versions are stated as through 2.2.1; a fixed version is not stated. A workaround is not stated. Exploitation in the wild is not stated, and no detection guidance is given beyond the vulnerable code shown. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Bottelet/DaybydayCRM/blob/2.…roller.php#L232-L245 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Bottelet DaybydayCRM Bottelet DaybydayCRM DaybydayCRM NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	High	8.8	CVE-2026-110018	The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all... Kodezen LLC, aBlocksKodezen LLC aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder, aBlocks	NVD	Oct 24 12:16 UTC
CVE-2026-110018The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Privilege Escalation in all... Executive summary The aBlocks WordPress plugin, which adds block and form builder features, has a privilege escalation flaw in all versions up to and including 2.17.0. An authenticated user with Contributor-level access or higher could use it to raise their own role, up to Editor on a standard installation. The advisory does not state a CVSS score or a fixed version. Technical summary The flaw is a privilege escalation issue caused by a REST endpoint at /ablocks/v1/form-builder/registration that is registered with a permission callback of __return_true and reads roleSlug from block attributes stored in post_content without checking that formType is registration. A Contributor can save a block with formType set to login to preserve an arbitrary roleSlug, then trigger the endpoint using a valid wp_rest nonce and post ownership check, and receive an authenticated session at the elevated role via WP_User::set_role() and wp_set_auth_cookie(). The advisory states that is_safe_registration_role() blocks roles holding manage_options, edit_users, delete_users, create_users, promote_users, or edit_theme_options, so the highest reachable role is said to be Editor. The fixed version, vendor workaround, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affects Kodezen LLC aBlocks Kodezen LLC aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder aBlocks NIST National Vulnerability DatabasePublished Oct 24, 2026 12:16 UTC Read the advisory
	Medium	4.3	CVE-2026-115998	IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 10:17 UTC
CVE-2026-115998IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from... Executive summary An access control flaw (IDOR) in Cervantes version v1.3-beta could let an authenticated user reach sensitive findings, proof-of-concept details, credentials, and client information. The advisory text is truncated and a related table lists several other Cervantes issues, with severities shown as Media, Baja, and Alta. The advisory does not state a fix or vendor recommendation. Technical summary The primary issue is an insecure direct object reference (IDOR) in Cervantes v1.3-beta, which the advisory says an authenticated attacker could use to access other users' data. The advisory's text is truncated, so the full attack preconditions are not stated. A related table also lists a broken object level authorization issue allowing cross-project target tampering, a stored XSS in the Notes field of project checklists, and broken access control in JiraController, with both Baja and Alta severity entries for CVE-2026-115975. Fixed versions, workarounds, and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	5.4	CVE-2026-115994	BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization,... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 10:17 UTC
CVE-2026-115994BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization,... Executive summary A flaw in Cervantes version v1.3-beta could let an attacker change or delete targets that belong to other projects without permission. The advisory describes the severity as Media (medium) in the listing table. The advisory does not state a vendor fix or recommended action beyond the description. Technical summary The flaw is a broken object level authorization (BOLA) issue, which allows cross-project target tampering in Cervantes v1.3-beta. An attacker can modify or delete targets belonging to other projects without authorization. The advisory does not state the attack preconditions, such as whether authentication is required. No fixed version, workaround, CVSS score, or detection guidance is stated in the advisory text provided. The related listing also shows other unrelated entries, which are not part of this advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.5	CVE-2026-114705	Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... quadlayersquadlayers WP Social Feed Gallery	NVD	Oct 24 10:17 UTC
CVE-2026-114705Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... Executive summary A broken access control flaw in the WP Social Feed Gallery WordPress plugin, versions 5.0.13 and earlier, lets users reach pages or actions they should not be allowed to use. The advisory rates it medium priority with a CVSS score of 6.5 and says it is expected to be exploited. The recommended action is to update the plugin, or ask a hosting provider or web developer for help if that is not possible. Technical summary The issue is classified as Broken Access Control, under OWASP A1, and is described as a Missing Authorization vulnerability. The advisory states that it affects WP Social Feed Gallery versions less than or equal to 5.0.13, and that the required privilege is unauthenticated. No official patch is listed as available, and no fixed version is stated. Patchstack has issued a mitigation rule that blocks attacks until an official patch is released, which the advisory presents as the interim workaround. The advisory does not state specific exploit details or attack steps, and it gives no detection guidance beyond the mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects quadlayers quadlayers WP Social Feed Gallery NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.5	CVE-2026-114194	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... Igor Funa, WordPressIgor Funa Ad Inserter, WordPress Ad Inserter Plugin	NVD	Oct 24 10:17 UTC
CVE-2026-114194Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects... From the advisory Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18. Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Igor Funa WordPress Igor Funa Ad Inserter WordPress Ad Inserter Plugin NIST National Vulnerability DatabasePublished Oct 24, 2026 10:17 UTC Read the advisory
	Medium	6.8	CVE-2026-115993	Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with... CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 09:16 UTC
CVE-2026-115993Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with... Executive summary A stored cross-site scripting flaw affects the Notes field of Checklists in Cervantes version v1.3-beta. The advisory says an attacker could run code in another user's browser, and it rates the issue as Media severity. Technical summary The flaw is stored cross-site scripting in the Notes field of Checklists, which allows arbitrary script execution in another user's browser. The advisory text is truncated, so the attack vector and user interaction required are not fully stated. The vendor and fixed version are not stated, and no workaround or detection guidance is given. The table in the advisory lists the same CVE as Media severity, dated 24 oct 2026, with the description 'Stored XSS in the Notes field of project checklists.' No CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 09:16 UTC Read the advisory
	Critical	9.8	CVE-2026-94075	Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. Tribulant SoftwareTribulant Software Newsletters	NVD	Oct 24 08:16 UTC
CVE-2026-94075Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.1. Executive summary A deserialization flaw in the Newsletters WordPress plugin by Tribulant Software lets unauthenticated attackers run harmful code on affected websites. The advisory rates it 9.8 out of 10 severity and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the plugin to version 4.18.2 or later. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3 Injection. The advisory states it requires no privileges (unauthenticated) and gives a CVSS severity of 9.8, with the affected range listed as through 4.18.1 and the patched version as 4.18.2. The advisory describes the attack vector only in general terms and does not give the specific vulnerable parameter or request. Workarounds are not stated beyond a Patchstack mitigation rule that blocks attacks, and the vendor's own fix is updating to 4.18.2 or later. No detection guidance, indicators of compromise, or confirmation of active exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Tribulant Software Tribulant Software Newsletters NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-115975	Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects CervantesSec, CervantesCervantesSec cervantes, Cervantes	NVD	Oct 24 08:16 UTC
CVE-2026-115975Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, edit, or delete Jira tickets for vulnerabilities in other projects Executive summary A broken access control flaw in the JiraController component of Cervantes v1.3-beta could let an attacker create, edit, or delete Jira tickets for vulnerabilities belonging to other projects. The advisory text includes a severity table with entries marked both Alta (high) and Baja (low) for this CVE, so the overall severity is unclear from the text. The advisory does not state a vendor fix or recommended remediation. Technical summary The flaw is a broken access control issue (authorization bypass) in JiraController in Cervantes v1.3-beta, allowing modification of Jira tickets tied to other projects. The advisory does not state the attack vector, required privileges, or user interaction needed, though the description implies an authenticated or reachable attacker. No fixed version, workaround, or detection guidance is stated. The embedded table lists this CVE twice with severities Baja and Alta, and the advisory does not explain the discrepancy. A related table entry lists different CVEs (CVE-2026-115998, CVE-2026-115994, CVE-2026-115993) that are not clearly tied to this advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from grayback.es/advisories Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects CervantesSec Cervantes CervantesSec cervantes Cervantes NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114697	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... QuarkA, PatchstackQuarkA QA Analytics, Patchstack QA Analytics	NVD	Oct 24 08:16 UTC
CVE-2026-114697Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue... Executive summary A cross-site scripting flaw in the QA Analytics WordPress plugin, versions 5.3.0.1 and earlier, lets attackers inject malicious scripts into affected websites. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The recommended action is to update the plugin to version 5.3.0.2 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability, classified under OWASP A3: Injection, in the QA Analytics plugin for WordPress. The advisory states that vulnerable versions are 5.3.0.1 and earlier and that the patched version is 5.3.0.2. Exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form, while the attacker needs no authentication. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, but the advisory does not describe other workarounds. Detection guidance beyond the mitigation rule is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects QuarkA Patchstack QuarkA QA Analytics Patchstack QA Analytics NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114695	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This... Infomaniak NetworkInfomaniak Network VOD Infomaniak	NVD	Oct 24 08:16 UTC
CVE-2026-114695Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This... Executive summary A cross-site scripting flaw affects the VOD Infomaniak WordPress plugin, versions 1.5.14 and earlier. Patchstack rates it medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor-side recommendation is to update the plugin to version 1.5.15 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability in the VOD Infomaniak WordPress plugin, classified under OWASP A3: Injection. The advisory states that the required privilege is unauthenticated, but that exploitation requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are stated as <= 1.5.14 and the patched version is 1.5.15. Patchstack has issued a mitigation rule to block attacks until the plugin is updated, and it advises auto-update for vulnerable plugins. The advisory does not state any further workaround, the exact vector string, or detection guidance, and it does not state whether exploitation in the wild has been observed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Infomaniak Network Infomaniak Network VOD Infomaniak NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114694	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Pixelite, PatchstackPixelite Events Manager	NVD	Oct 24 08:16 UTC
CVE-2026-114694Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the Events Manager WordPress plugin up to version 7.4.8. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited, and it recommends updating the plugin to version 7.4.9 or later. Technical summary The flaw is a reflected cross-site scripting (XSS) issue classified under OWASP A3: Injection, which lets injected scripts run in a visitor's browser. The advisory lists the required privilege as unauthenticated but says exploitation requires a privileged user to take an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as 7.4.8 and earlier, and the patched version is 7.4.9. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any further workarounds or specific detection guidance beyond updating and the mitigation rule. It does not state whether exploitation in the wild has been confirmed. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Pixelite Patchstack Pixelite Events Manager NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	6.5	CVE-2026-114693	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Plugins360 Labs, PatchstackPlugins360 Labs All-in-One Video Gallery, Patchstack All-in-One Video Gallery	NVD	Oct 24 08:16 UTC
CVE-2026-114693Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows... Executive summary A cross-site scripting flaw affects the WordPress All-in-One Video Gallery plugin, versions 4.9.7 and earlier. The publisher Patchstack rates it medium priority with a CVSS score of 6.5. The recommended action is to update the plugin to version 5.0.0 or later. Technical summary The advisory classifies this as cross-site scripting (XSS), which Patchstack maps to OWASP A3: Injection. Exploitation requires a privileged user, with the required privilege listed as Subscriber, to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are 4.9.7 and earlier, and the patched version is 5.0.0. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and it states that the vulnerability is expected to become exploited. The advisory does not state any detection indicators or additional workarounds beyond the update and mitigation rule. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L Affects Plugins360 Labs Patchstack Plugins360 Labs All-in-One Video Gallery Patchstack All-in-One Video Gallery NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.8	CVE-2026-114196	Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. paytiumsupport, Patchstackpaytiumsupport Paytium	NVD	Oct 24 08:16 UTC
CVE-2026-114196Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5. Executive summary A deserialization flaw in the Paytium WordPress plugin, versions up to and including 5.0.5, lets unauthenticated attackers inject PHP objects. The advisory rates it critical at CVSS 9.8 and says it is expected to be exploited in mass campaigns. The vendor recommends updating the plugin to version 5.0.6 or later. Technical summary The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3: Injection. The advisory states the attack requires no privileges (unauthenticated) and gives a CVSS score of 9.8. Affected versions are stated as n/a through 5.0.5 and <= 5.0.5, with the patched version 5.0.6. The advisory says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, but it does not describe a manual workaround, the specific vulnerable code path, or indicators of compromise and detection guidance. Whether exploitation in the wild has been observed is not stated beyond the expectation that it will be exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects paytiumsupport Patchstack paytiumsupport Paytium NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	5.9	CVE-2026-114190	Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This... Hai Zheng / Lite Speed Cache, Hai ZhengHai Zheng / Lite Speed Cache LiteSpeed Cache, Hai Zheng LiteSpeed Cache	NVD	Oct 24 08:16 UTC
CVE-2026-114190Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This... Executive summary A sensitive data exposure flaw affects the LiteSpeed Cache WordPress plugin, versions 7.9 and earlier. The advisory rates it medium priority with a CVSS severity of 5.9 and says attackers use this class of flaw in mass-exploit campaigns. The recommended action is to update the plugin to version 7.9.1 or later. Technical summary The advisory describes an insertion of sensitive information into sent data vulnerability, classified as Sensitive Data Exposure (OWASP A3), in the LiteSpeed Cache plugin by Hai Zheng. The required privilege is stated as unauthenticated, so no account is needed to exploit it. Vulnerable versions are <= 7.9 and the patched version is 7.9.1. The advisory recommends updating to 7.9.1 or later and notes that no virtual patch rule can be assigned, so updating is the only listed mitigation. Workarounds beyond updating, the specific data exposed in the response, and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Affects Hai Zheng / Lite Speed Cache Hai Zheng Hai Zheng / Lite Speed Cache LiteSpeed Cache Hai Zheng LiteSpeed Cache NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114179	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This... wordpluswordplus BP Better Messages	NVD	Oct 24 08:16 UTC
CVE-2026-114179Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This... Executive summary A cross-site scripting flaw affects the BP Better Messages WordPress plugin, versions 3.1.3 and earlier. The advisory rates it medium priority with a CVSS severity of 7.1 and says it is expected to be exploited, and it recommends updating the plugin to version 3.1.4 or later. Technical summary The flaw is a cross-site scripting (XSS) issue, classed as improper neutralization of input during web page generation, described as DOM-based. The advisory says it can be started by an unauthenticated user, but successful exploitation requires a privileged user to perform an action such as clicking a malicious link or visiting a crafted page. Vulnerable versions are stated as 3.1.3 and earlier, and the patched version is 3.1.4. The advisory recommends updating to 3.1.4 or later and says Patchstack has issued a mitigation rule that blocks attacks until the site is patched. Workarounds beyond the mitigation rule are not stated, and no detection guidance or indicators of compromise are given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects wordplus wordplus BP Better Messages NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-114178	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue... Bold GridBold Grid W3 Total Cache	NVD	Oct 24 08:16 UTC
CVE-2026-114178Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue... Executive summary A cross-site scripting flaw affects the W3 Total Cache WordPress plugin by Bold Grid, in versions up to and including 2.10.7. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could inject scripts that steal visitor data or hijack accounts. The recommended fix is to update the plugin to version 2.11.0 or later. Technical summary The flaw is a stored cross-site scripting (XSS) issue classified under OWASP A3: Injection, caused by improper neutralization of input during web page generation. The advisory lists the required privilege as unauthenticated, but says exploitation requires a privileged user to take an action such as clicking a malicious link, visiting a crafted page, or submitting a form. Vulnerable versions are stated as <= 2.10.7 and the patched version as 2.11.0. Patchstack has issued a mitigation rule that blocks attacks until the site is updated, and it recommends updating to 2.11.0 or later. The advisory does not state any further workarounds or specific detection guidance beyond this. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Bold Grid Bold Grid W3 Total Cache NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112869	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Noah Hearle, PatchstackNoah Hearle We’re Open!, Patchstack We're Open!	NVD	Oct 24 08:16 UTC
CVE-2026-112869Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue... Executive summary A cross-site scripting flaw affects the We're Open! opening-hours plugin for WordPress, versions 2.6 and earlier. The advisory rates it as medium priority with a CVSS severity of 7.1 and says attackers could use it to steal visitor data or hijack accounts. The vendor recommends updating the plugin to version 2.7 or later. Technical summary This is a reflected cross-site scripting (XSS) vulnerability classed as OWASP A3: Injection. The advisory states that it can be started by an unauthenticated user, but a privileged user must take an action such as clicking a malicious link or submitting a form for exploitation to succeed. Vulnerable versions are listed as 2.6 and earlier, and the patched version is 2.7. The advisory recommends updating to 2.7 or later and notes that Patchstack has issued a mitigation rule that blocks attacks until the update is applied. It does not state a manual workaround beyond that, nor does it state whether exploitation has been observed in the wild, and it gives no specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Noah Hearle Patchstack Noah Hearle We’re Open!Patchstack We're Open! NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.3	CVE-2026-112866	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL... WPFactoryWPFactory Product Filter by WBW	NVD	Oct 24 08:16 UTC
CVE-2026-112866Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-product-filter allows Blind SQL... Executive summary A SQL injection flaw in the Product Filter by WBW WordPress plugin, made by WPFactory, lets attackers read, change, or delete data in a website's database. The advisory rates it 9.3 on the CVSS scale and says it is highly dangerous and expected to become exploited. The recommended fix is to update the plugin to version 3.4.7 or later. Technical summary The weakness is classified as SQL Injection (OWASP A3: Injection), and the advisory states that it can be exploited without authentication (required privilege: unauthenticated). Vulnerable versions are listed as 3.4.6 and earlier, with 3.4.7 as the patched version. The advisory describes the impact as the ability to read, modify, or delete the entire database, but does not give technical details of the injection point, request format, or exploit steps. Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, and the advisory says the vendor recommends updating to 3.4.7 or later. Workarounds beyond the Patchstack rule and update, and specific detection guidance, are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects WPFactory WPFactory Product Filter by WBW NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	High	7.1	CVE-2026-112844	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue... arrayticsarraytics WP Event Solution	NVD	Oct 24 08:16 UTC
CVE-2026-112844Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue... Executive summary A cross-site scripting flaw in the WP Event Solution WordPress plugin, made by Arraytics, lets attackers inject malicious scripts into affected websites. The advisory rates it as medium priority with a CVSS severity of 7.1 and says it is expected to be exploited. The vendor recommends updating the plugin to version 4.1.27 or later. Technical summary This is a stored cross-site scripting (XSS) vulnerability classified under OWASP A3: Injection. The advisory states the required privilege is unauthenticated, but also that successful exploitation requires a privileged user to perform an action such as clicking a malicious link or submitting a form. Vulnerable versions are listed as 4.1.26 and earlier, and the patched version is 4.1.27. The advisory recommends updating to 4.1.27 or later and says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated. Workarounds beyond the mitigation rule and any detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects arraytics arraytics WP Event Solution NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Critical	9.3	CVE-2026-111402	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Tribulant Software, PatchstackTribulant Software Newsletters	NVD	Oct 24 08:16 UTC
CVE-2026-111402Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This... Executive summary A SQL injection flaw affects the Newsletters plugin for WordPress, made by Tribulant Software, in versions 4.18.1 and earlier. The publisher rates it 9.3 on CVSS and says it is highly dangerous and likely to be used in mass-exploit campaigns, so the advisory recommends updating the plugin to version 4.18.2 or later right away. Technical summary This is an SQL injection vulnerability (OWASP A3: Injection) in the Newsletters WordPress plugin, versions 4.18.1 and earlier, with a CVSS severity of 9.3 and a Patchstack priority of High. The advisory states that it can be exploited by an unauthenticated attacker, and that successful exploitation could let an attacker read, modify, or delete the entire database, including user accounts and private data. The patched version is 4.18.2, and the advisory says to update to 4.18.2 or later. Patchstack has issued a mitigation rule that blocks attacks until the site is updated. The advisory does not state any other workarounds, and it does not give specific detection guidance or indicate whether exploitation has been observed in the wild beyond saying it is expected to become exploited. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L Affects Tribulant Software Patchstack Tribulant Software Newsletters NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Medium	6.5	CVE-2026-110892	Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash:... Brainstorm ForceBrainstorm Force SureDash	NVD	Oct 24 08:16 UTC
CVE-2026-110892Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash:... Executive summary A broken access control flaw in the SureDash WordPress plugin, made by Brainstorm Force, lets users reach pages or actions they should not be able to use. The advisory rates it at CVSS 6.5 but says it has low severity impact and is unlikely to be exploited. The vendor's recommended fix is to update the plugin to version 1.12.3 or later. Technical summary The weakness is classified as Broken Access Control, with a missing authorization check described in the advisory. The advisory states the affected versions are 1.12.2 and earlier, and the patched version is 1.12.3. The required privilege is Subscriber, so an authenticated low-privilege account is the stated precondition. The advisory does not state any workaround other than updating, and it does not give detection guidance or indicate whether exploitation has been observed in the wild. The CVSS vector string is not stated; only the score of 6.5 is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from patchstack.com/database/wordpress/plugi…rability-3?_s_id=cve Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Affects Brainstorm Force Brainstorm Force SureDash NIST National Vulnerability DatabasePublished Oct 24, 2026 08:16 UTC Read the advisory
	Low	2.1	CVE-2026-115803	A flaw has been found in Scada-LTS 2.8.0 Scada-LTS, AmChartsScada-LTS, AmCharts Data API	NVD	Oct 24 07:16 UTC
CVE-2026-115803A flaw has been found in Scada-LTS 2.8.0 Executive summary A flaw has been found in Scada-LTS version 2.8.0, an industrial control system monitoring product. The advisory says the flaw can allow authorization bypass and that a public exploit has been published. The vendor says a new release with security enhancements is in development but has not yet been released. Technical summary The weakness is an authorization bypass in the AmCharts Data API component, specifically in the AmChartValuesAPI.java file where HttpServletRequest.getParameter handles the ids argument. The attack can be launched remotely by manipulating the ids argument; the advisory does not state any authentication preconditions. Affected versions are stated as Scada-LTS 2.8.0 only, and no fixed version is stated. The vendor says a new release with security enhancements is in progress and will be introduced soon. No workaround, detection guidance, CVSS score, or in-the-wild exploitation status is stated, though the advisory says an exploit has been published and may be used. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Scada-LTS AmCharts Scada-LTS AmCharts Data API NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Low	2.1	CVE-2026-115802	A weakness has been identified in InternScience InternAgent 1.5.0 InternScienceInternScience InternAgent	NVD	Oct 24 07:16 UTC
CVE-2026-115802A weakness has been identified in InternScience InternAgent 1.5.0 Executive summary A weakness has been identified in InternScience InternAgent 1.5.0, an open-source agentic framework for autonomous scientific research. The advisory text provided does not describe the severity of the weakness, and the advisory does not state a fix or vendor recommendation. Technical summary The advisory text is a copy of the InternAgent GitHub repository page and only states that a weakness exists in InternAgent 1.5.0. The vulnerability class, attack vector, and preconditions are not stated. Affected version range beyond 1.5.0, fixed version, workaround, CVSS score, exploitation status, and detection guidance are not stated. Defenders should consult the NVD entry and the vendor repository for technical details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/InternScience/InternAgent Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects InternScience InternScience InternAgent NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Medium	6.8	CVE-2026-108013	BigFix Platform uses Mozilla CA certificate bundle (PEM) Mozilla, HCL Software, BigFixHCL Software BigFix Platform, BigFix Platform, Mozilla CA certificate bundle	NVD	Oct 24 07:16 UTC
CVE-2026-108013BigFix Platform uses Mozilla CA certificate bundle (PEM) Executive summary The advisory says that the BigFix Platform ships an outdated Mozilla CA certificate bundle that still trusts certificates whose private keys have been compromised. An attacker positioned between the product and a server could impersonate that server and tamper with files the product downloads. The advisory states the fix is to use a bundle dated 2026/10/20 or later, available starting from BES Support v1520. Technical summary This is a trust validation weakness caused by an outdated certificate authority bundle in the BigFix Platform. Bundles dated before 2026/10/20 still trust certificates whose private keys are compromised, so an on-path attacker can impersonate remote servers during validation. The attack requires a network position between the product and the target server, and the advisory describes file tampering as the impact. The fix is bundle version 2026/10/20 or later, available starting from BES Support v1520. The advisory does not state a CVSS score, exploitation status, or any workaround, and it does not give detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Mozilla HCL Software BigFix HCL Software BigFix Platform BigFix Platform Mozilla CA certificate bundle NIST National Vulnerability DatabasePublished Oct 24, 2026 07:16 UTC Read the advisory
	Medium	5.4	CVE-2026-97353	The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX... News KitNews Kit Addons For Elementor	NVD	Oct 24 06:16 UTC
CVE-2026-97353The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX... Executive summary The News Kit Addons For Elementor WordPress plugin, through version 1.4.7, has a flaw that lets users without the right permissions change post data. The advisory rates it medium severity with a CVSS score of 5.4, and it states no known fix is available. Technical summary The flaw is a missing authorization (broken access control, CWE-862) in one of the plugin's authenticated AJAX actions, which does not check user capability or ownership before updating post metadata. The advisory does not state the exact attacker privilege level required beyond being authenticated, though the vulnerable endpoint is described as authenticated. Affected versions are listed as through 1.4.7, and no fixed version is stated. No workaround is stated, and no detection guidance is provided. The advisory also lists several unrelated plugin titles in its Other section, which are not part of this flaw. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/4114e6a4-d8ed-…56-a15f-4d47034ae75f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects News Kit News Kit Addons For Elementor NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	4.3	CVE-2026-97352	The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with... News Kit Addons For ElementorNews Kit Addons For Elementor news-kit-elementor-addons	NVD	Oct 24 06:16 UTC
CVE-2026-97352The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with... Executive summary The News Kit Addons For Elementor WordPress plugin contains a flaw that lets logged-in users perform actions they should not be allowed to perform. The advisory rates it medium severity with a CVSS score of 4.3, and the fix is to update the plugin to version 1.4.9 or later. Technical summary The flaw is a missing authorization (broken access control, CWE-862) caused by the plugin not performing a capability check on one of its AJAX actions. The advisory says authenticated users with low-level access can exploit it, and the advisory text is cut off before it fully describes the required privileges. The affected version range is stated as before 1.4.9, and the fixed version is 1.4.9. The advisory does not state a workaround. It also does not state whether exploitation has been observed in the wild, and no detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/36f192be-f684-…4c-8b37-9dd006407b6f Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects News Kit Addons For Elementor News Kit Addons For Elementor news-kit-elementor-addons NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.5	CVE-2026-87835	The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing... Front End UsersFront End Users	NVD	Oct 24 06:16 UTC
CVE-2026-87835The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing... Executive summary The Front End Users WordPress plugin, through version 3.2.35, lets a website visitor set account attributes they should not control when they register through the front-end forms. The advisory does not give a severity rating from the vendor, though a CVSS score of 6.4 (medium) is listed, and it states no known fix is available. Technical summary The weakness is classified as broken access control (CWE-284): the plugin does not restrict which account attributes a visitor may set during front-end registration. The advisory text is truncated after the words 'allowing...', so the full impact is not stated. The attack vector is listed as network-reachable registration forms, but any required privileges, user interaction, or exact exploitation steps are not stated. The affected version is through 3.2.35, and a fixed version is not stated because the advisory says there is no known fix. Workarounds and detection guidance are not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/9a761c19-1608-…f7-9ab3-f92f3fc0aadf Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects Front End Users Front End Users NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-114429	The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... WPVRWPVR	NVD	Oct 24 06:16 UTC
CVE-2026-114429The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could... Executive summary The WPVR WordPress plugin, versions before 9.0.3, contains a flaw that could let attackers inject malicious scripts into pages shown to visitors. The advisory rates it as medium severity, with a CVSS score of 6.8, and the fix is to update to version 9.0.3. Technical summary The flaw is a cross-site scripting (XSS) issue, classified as CWE-79, in which tour hotspot content is not properly sanitised or escaped before it is stored and output on the front end. The advisory does not state the exact attack preconditions beyond the description that the flaw could be exploited, so the required privilege level is not stated in the provided text. The affected version range is stated as before 9.0.3, and the fixed version is 9.0.3. The advisory does not state any workaround, and it gives no detection guidance or information on exploitation in the wild. The CVSS score is listed as 6.8 (medium), and the advisory does not provide a full vector string. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/30409336-b8ed-…f7-bc40-96c21f494155 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects WPVR WPVR NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Low	3.7	CVE-2026-113674	The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113674The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets logged-out users edit listings they do not own. The advisory rates the issue low severity with a CVSS score of 3.7 and says the fix is in version 2.8.194. Site owners should update the plugin to 2.8.194 or later. Technical summary The flaw is a broken access control issue (CWE-284) in which the plugin does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited. The advisory says the issue allows unauthorized edits, and the snippet is truncated so the full impact is not shown. The vulnerable versions are described as those before 2.8.194, and the fixed version is 2.8.194. The CVSS score is 3.7 (low) as stated. No workaround, exploitation status in the wild, or detection guidance is stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/23e66ca1-50eb-…c1-9f5f-f830235c5af0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.2	CVE-2026-113673	The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113673The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets an administrator-defined text value be written unsafely into a generated PHP file. The advisory rates it high severity with a CVSS score of 7.2 and says the fix is to update to version 2.8.194. Technical summary The weakness is classified as CWE-94 (code injection) and as remote code execution, and the advisory states that administrator-defined text is not properly escaped before it is written into a generated PHP file in the plugin's own folder. The advisory text is truncated, so the attack vector and preconditions beyond the administrator-defined input are not fully stated. Affected versions are stated as before 2.8.194, and the fixed version is 2.8.194. Workarounds are not stated. Detection guidance is not stated. The CVSS vector string is not stated; only the score of 7.2 (high) is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/7ef117ed-1fd6-…e6-b242-87a7b65d3477 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-113493	The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113493The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, contains a cross-site scripting flaw in its map shortcode handling. The advisory rates it medium severity (CVSS 6.8, as listed) and the fix is to update the plugin to 2.8.194 or later. Technical summary The flaw is cross-site scripting (CWE-79) caused by the plugin not sanitising or escaping some map shortcode attributes before outputting them inside a style attribute. The advisory's text is truncated, so the attack vector and required privileges are not fully stated. The fixed version is 2.8.194, and the advisory lists the plugin as before that version. Workarounds are not stated. Detection guidance is not stated. The listed CVSS score of 6.8 (medium) comes from the advisory's metadata. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/a46bd6e9-4037-…13-b36d-e418a2ed41b7 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113492	The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113492The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers,... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that can expose sensitive data to people who are not logged in. The advisory rates it medium severity with a CVSS score of 5.3. The fix is to update the plugin to version 2.8.194 or later. Technical summary The flaw is a sensitive data disclosure, classified as CWE-200, in which one of the plugin's unauthenticated AJAX handlers loads listings without performing status, ownership, or password checks. The advisory states it can be reached without authentication, and the affected version range is given only as before 2.8.194. The fixed version is 2.8.194. The advisory does not state any workaround. It does not state whether exploitation in the wild has been observed, and it gives no detection guidance. The advisory text is truncated, so the full description of the affected handler is not available. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/5a1c17a0-c513-…64-91c7-09c0f1878c71 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.4	CVE-2026-113491	The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113491The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing, allowing... Executive summary The GeoDirectory WordPress plugin is affected by a path traversal flaw that can allow an attacker to misuse file handling on a website. The advisory lists the fix as version 2.8.194 and gives a medium severity score of 6.4, with no further impact details stated. Technical summary The flaw is a path traversal (CWE-22) in the GeoDirectory WordPress plugin before 2.8.194, where a user-supplied image URL is used as a local file path when saving a front-end listing without validation. The advisory states the issue allows access through this path, but the exact impact is cut off in the text. The attack vector, required privileges, and user interaction are not stated. The fixed version is 2.8.194, and the advisory lists a CVSS score of 6.4 (medium). No workaround and no detection guidance are stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/ba2114a5-01e3-…e7-a7f6-673674b6501d Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.3	CVE-2026-113490	The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113490The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST... Executive summary The GeoDirectory WordPress plugin, before version 2.8.194, can expose information about listings to people who should not see it. The advisory rates the issue medium severity with a CVSS score of 5.3, and the fix is to update to version 2.8.194. Technical summary The flaw is a missing status or ownership check (CWE-200, sensitive information disclosure) when a listing's map popup is rendered through a single-item REST endpoint in the GeoDirectory plugin. The advisory states the plugin is affected before 2.8.194 and fixed in 2.8.194. The attack vector, required privileges, and exact data exposed are not stated beyond the classification. Workarounds are not stated. Detection guidance is not stated. The CVSS score given is 5.3 (medium). Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2901f8f3-0b35-…65-b248-6c0dfc5de894 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	4.3	CVE-2026-113489	The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... GeoDirectoryGeoDirectory	NVD	Oct 24 06:16 UTC
CVE-2026-113489The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access... Executive summary The GeoDirectory WordPress plugin is affected by a flaw that lets low-privileged logged-in users (Subscriber level) reference attachments they do not own when saving a listing. The advisory rates it medium severity with a CVSS score of 4.3, and the fix is to update the plugin to version 2.8.194. Technical summary The weakness is an insecure direct object reference (CWE-639, broken access control) in which the plugin does not verify that a referenced attachment belongs to the listing being saved. The attack requires an account with Subscriber-level access and the advisory states the attacker can exploit it from there. The plugin is fixed in version 2.8.194, and the advisory says the flaw exists in versions before 2.8.194. The advisory does not state any workaround or mitigation, and it gives no detection guidance or exploitation-in-the-wild information. The rest of the advisory text lists unrelated plugin vulnerabilities from other vendors, which are not part of this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/2f539d43-6f95-…4f-b399-21697145591e Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affects GeoDirectory GeoDirectory NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.1	CVE-2026-112207	The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the... Download MonitorDownload Monitor download-monitor	NVD	Oct 24 06:16 UTC
CVE-2026-112207The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the... Executive summary The Download Monitor WordPress plugin is affected by a cross-site scripting flaw that the advisory says is high severity, with a CVSS score of 7.1 listed. The vendor's recommended action is to update the plugin to version 5.3.4, which the advisory identifies as the fixed version. Technical summary The flaw is a cross-site scripting (XSS, CWE-79) issue in which the plugin does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the content. The advisory does not describe the exact attack vector or required user interaction beyond the clicked link, and it does not state the affected version range beyond 'before 5.3.4'. The fixed version is 5.3.4. The advisory does not state any workaround, and it gives no detection guidance or information on whether the flaw is being exploited in the wild. The CVSS score is listed as 7.1 (high), but the vector string is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/03d5e83b-3119-…62-b1be-8c6fe53f9963 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affects Download Monitor Download Monitor download-monitor NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Critical	9.8	CVE-2026-110956	The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a... asVereinbaseasVereinbase	NVD	Oct 24 06:16 UTC
CVE-2026-110956The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a... Executive summary A WordPress plugin called asVereinbase, used on WordPress sites, has an authentication bypass flaw that lets attackers log in as users without a valid password or second factor. The advisory rates it critical with a CVSS score of 9.8 and says the fix is version 1.1.8. Technical summary The flaw is classified as an authentication bypass (CWE-287, OWASP A2 Broken Authentication): the plugin does not require a valid password or genuine second factor before authenticating a user and treats an empty stored value as a match. The advisory describes the attack vector and preconditions only partially; the text is truncated and does not state them explicitly. Affected versions are stated as before 1.1.8, and the fixed version is 1.1.8. No workaround is stated. No detection guidance or evidence of exploitation in the wild is stated. The advisory lists a CVSS score of 9.8 (critical) and a WPVDB ID but gives no further exploitation details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/95501052-9f20-…91-9171-184cd2e4a445 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects asVereinbase asVereinbase NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.5	CVE-2026-107907	The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce... MAS VideosMAS Videos	NVD	Oct 24 06:16 UTC
CVE-2026-107907The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce... Executive summary The MAS Videos WordPress plugin, through version 1.3.4, lets people without permission delete videos and playlists from the front end of a website. The advisory rates the issue as medium severity with a CVSS score of 6.5. No fixed version or vendor recommendation is stated in the advisory. Technical summary The flaw is a missing authorization check (CWE-862, OWASP A5 Broken Access Control) in the MAS Videos WordPress plugin through 1.3.4. The plugin does not check capability or ownership when handling front-end video and playlist deletion requests, and the advisory text is truncated after mentioning a nonce, so the nonce requirement and exact preconditions are not fully stated. The advisory lists the CVSS score as 6.5 (medium). It states no known fix, so no fixed version is given. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/00de2695-275a-…1e-bd64-9a8c54235c23 Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Affects MAS Videos MAS Videos NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	5.4	CVE-2026-107887	The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child ,... Advanced Twenty SeventeenAdvanced Twenty Seventeen advanced-twenty-seventeen	NVD	Oct 24 06:16 UTC
CVE-2026-107887The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child ,... Executive summary The Advanced Twenty Seventeen WordPress plugin is affected by a missing authorization flaw that lets unauthorized users trigger an action that creates and activates a bundled child theme. The advisory rates it medium severity with a CVSS score of 5.4. No fix is listed as known, so the advisory does not state a remediation path. Technical summary The flaw is classified as CWE-862 (missing authorization) and as broken access control, because the plugin performs no capability or nonce check on the action that creates and activates its bundled child theme. The advisory does not state the attack preconditions beyond the missing check, though the classification type is listed as no authorisation. The advisory says the affected product is advanced-twenty-seventeen through version 1.3.1, and it lists no known fix. No workaround, detection guidance, or evidence of exploitation in the wild is stated. The CVSS 5.4 (medium) score and the CVE were published on 2026-10-21 per the timeline. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/e252c7ee-368d-…fb-a964-06804747c162 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects Advanced Twenty Seventeen Advanced Twenty Seventeen advanced-twenty-seventeen NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	Medium	6.8	CVE-2026-105199	The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any... Pixel Tag Manager for WooCommercePixel Tag Manager for WooCommerce pixel-manager-for-woocommerce	NVD	Oct 24 06:16 UTC
CVE-2026-105199The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any... Executive summary The Pixel Tag Manager for WooCommerce WordPress plugin, versions before 2.2.3, contains a flaw that lets people without proper permission use one of its AJAX actions. The advisory classifies the issue as cross-site scripting with a CVSS score of 6.8 (medium), and the fix is version 2.2.3. Technical summary The advisory classifies the flaw as cross-site scripting (CWE-79) caused by a missing capability check in one AJAX action, which exposes the nonce that protects it to any authenticated or unauthenticated user as the advisory describes it. The advisory states the affected plugin is pixel-manager-for-woocommerce, fixed in version 2.2.3, and rates it 6.8 (medium). The advisory text does not state specific affected version ranges beyond 'before 2.2.3', the exact attack vector details beyond the summary, any workaround, or whether exploitation has been observed. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from wpscan.com/vulnerability/69d7c59c-77d1-…2d-8ad7-6066dad59013 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H Affects Pixel Tag Manager for WooCommerce Pixel Tag Manager for WooCommerce pixel-manager-for-woocommerce NIST National Vulnerability DatabasePublished Oct 24, 2026 06:16 UTC Read the advisory
	High	7.1	CVE-2026-115807	The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Cozmoslabs, WordPress, User Profile BuilderCozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, User Profile Builder, WordPress	NVD	Oct 24 05:17 UTC
CVE-2026-115807The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all... Executive summary The User Profile Builder plugin for WordPress contains a flaw that lets users with Author-level access and above create new accounts with higher-privilege roles such as Editor. The advisory describes this as a limited privilege escalation affecting all versions up to and including 4.0.3. The advisory does not state a severity rating or a vendor fix recommendation. Technical summary The flaw is a privilege escalation caused by missing server-side authorization: the Gutenberg Register block passes an attacker-controlled Assigned Role attribute into the [wppb-register] shortcode. The role guard only downgrades roles holding manage_options or remove_users, so roles such as Editor are not restricted. Exploitation requires an authenticated attacker with Author-level access or higher. Affected versions are stated as all versions up to and including 4.0.3, and a fixed version is not stated. A CVSS score, workarounds, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Affects Cozmoslabs WordPress User Profile Builder Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor User Profile Builder WordPress NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	Critical	9.8	CVE-2026-115806	The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Codexonics, Prime Mover, FreemiusCodexonics Prime Mover – Backup and Migration, Prime Mover – Backup and Migration, Freemius	NVD	Oct 24 05:17 UTC
CVE-2026-115806The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted... Executive summary The Prime Mover Backup and Migration plugin for WordPress has a flaw that lets an unauthenticated attacker plant malicious data through the comment form, which can be triggered when an administrator runs a routine export or restore. The advisory describes this as a PHP Object Injection issue that can enable serious compromise of the site. The advisory text provided does not state a fixed version or the vendor's specific recommendations. Technical summary The flaw is PHP Object Injection caused by unsafe deserialization of untrusted input in the migration search-and-replace routine (recursiveUnserializeReplace()). An unauthenticated attacker stores a base64-encoded serialized object in wp_comments.comment_content through wp-comments-post.php, and it is later decoded and passed to unserialize() without allowed_classes restriction when an administrator performs an export or restore. The advisory states a POP chain exists in the bundled Freemius library, so no additional plugin is required. All versions up to and including 2.2.1 are described as vulnerable. A fixed version, workaround, CVSS score, and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Codexonics Prime Mover Freemius Codexonics Prime Mover – Backup and Migration Prime Mover – Backup and Migration Freemius NIST National Vulnerability DatabasePublished Oct 24, 2026 05:17 UTC Read the advisory
	High	7.6	CVE-2026-115929	MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store electron, MongoDB, Inc.electron, MongoDB, Inc. MongoDB Compass	NVD	Oct 24 01:17 UTC
CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store Executive summary The advisory concerns MongoDB Compass, a desktop tool for MongoDB, whose TLS root certificate store comes from the bundled Electron runtime. The release notes say the issue was addressed by updating Electron, and the advisory does not state how severe the flaw is. The recommended action in the text is to use MongoDB Compass v1.53.1, which includes the updated Electron. Technical summary The advisory describes the flaw as a problem in Electron's own TLS root certificate store, which MongoDB Compass relies on. The vulnerability class, CVSS score, and attack vector are not stated. The fix is an Electron update included in MongoDB Compass 1.53.1, with the Electron v44.9.1 release notes cited as the reference for CVE-2026-115929. The affected Compass versions before 1.53.1 are not explicitly stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mongodb-js/compass/releases/tag/v1.53.1 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects electron MongoDB, Inc.electron MongoDB, Inc. MongoDB Compass NIST National Vulnerability DatabasePublished Oct 24, 2026 01:17 UTC Read the advisory
	Unknown	n/a	DSA-6583-1	libheif security update DebianDebian Linux, Debian libheif	Debian Security Advisories	Oct 24
DSA-6583-1libheif security update Executive summary Debian has released a security update for libheif, a library used to read and write HEIF and AVIF images. The advisory says that processing specially crafted images could cause denial of service or disclosure of process memory, and it recommends upgrading libheif packages. Technical summary The advisory describes multiple security issues in libheif, including denial of service through excessive resource consumption or crashes and disclosure of process memory when processing crafted images. It also addresses a use-after-free and double-free in timestamp handling during image encoding, including transcoding of crafted images. For the stable distribution (trixie), the fixed version is stated as 1.23.6-2~deb13u1. The advisory does not state CVE identifiers, CVSS scores, attack vector details beyond processing crafted images, or workarounds. Detection guidance is not stated, and the advisory refers readers to the Debian security tracker for detailed status. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from lists.debian.org/debian-security-announce/2026/msg00499.html Score No CVSS score published. Affects Debian Debian Linux Debian libheif Debian Security TeamPublished Oct 24, 2026 Read the advisory
	Critical	9.9	CVE-2026-115931	Postiz lets a signed-in user ask the backend to run a function on one of their connected channels GitroomHQGitroomHQ postiz-app	NVD	Oct 23 23:17 UTC
CVE-2026-115931Postiz lets a signed-in user ask the backend to run a function on one of their connected channels Executive summary A flaw in the Postiz social media scheduling application, published by GitroomHQ, lets any signed-in user read files and environment secrets from the server and crash the backend. The advisory rates it Critical with a CVSS v3.1 score of 9.9, and says registration must be closed to reduce exposure, but this does not fix the issue. The vendor's recommended fix is to upgrade to version 2.25.2. Technical summary The backend does not restrict which internal helper functions a signed-in user can invoke through the channel-function interface, classified as CWE-470 and CWE-73. A user who connects a channel whose stored token is a file path can make the backend return any file it can read, including its environment, which exposes the JWT signing secret, database and Redis connection strings, and provider credentials. A separate request terminates the backend process and can be repeated after each restart. The advisory states affected versions as 2.23.0 and later, with the fix in 2.25.2, and references commit 9383f5b as the patch. Self-registration is open by default, and setting DISABLE_REGISTRATION=true is given as a partial mitigation only. Detection guidance and exploitation in the wild are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from gadvisory.org/advisories/PSA-2026-JNXM56 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects GitroomHQ GitroomHQ postiz-app NIST National Vulnerability DatabasePublished Oct 23, 2026 23:17 UTC Read the advisory
	Critical	n/a	cisco-sa-php-october26-Jj384Daq	Vulnerabilities in PHP Affecting Cisco Products: October 2026 Cisco, PHPPHP, Cisco Duo Access Gateway, Cisco Ultra-Reliable Wireless Backhaul (URWB), Cisco Expressway Series, Cisco Expressway Select Series	Cisco PSIRT	Oct 23 22:39 UTC
cisco-sa-php-october26-Jj384DaqCVE-2026-109618CVE-2026-109619Vulnerabilities in PHP Affecting Cisco Products: October 2026 Executive summary Cisco published an advisory covering two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can lead to remote code execution. The advisory names a small set of Cisco products as affected, including Ultra-Reliable Wireless Backhaul, Expressway, and Duo Access Gateway, while many other Cisco products are listed as not affected or still under investigation. Cisco recommends applying the fixed software releases in the associated bug IDs and notes that workarounds exist for some products. Technical summary The flaws are remote code execution issues in PHP: CVE-2026-109618 is described as RCE via OOM corruption and CVE-2026-109619 as RCE via stale global state. The advisory does not state the network attack vector or other exploit preconditions for the core PHP flaws, but the Duo Access Gateway footnote says the attacker must be authenticated as an administrator for that product, with a CVSS vector of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H and a score of 6.6. Affected and fixed releases listed are Ultra-Reliable Wireless Backhaul (URWB) with fixed release 27.1.1 (Feb 2027) under bug CSCwx37073, Expressway Series and Expressway Select Series with fixed release 15.5.21 (TBD) under bug CSCwx37062, and Duo Access Gateway with fixed release 3.2.0. A workaround is stated for URWB, with details in its bug ID, and workarounds for other products are referenced to bug IDs. The advisory lists Snort rules 67359 and 67360 as action links, but it does not give further detection guidance. Cisco states it is aware of a public announcement but not of any malicious use, and it does not state a base CVSS score for the core PHP flaws. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from sec.cloudapps.cisco.com/security/center…p-october26-Jj384Daq Score No CVSS score published. Affects Cisco PHP PHP Cisco Duo Access Gateway Cisco Ultra-Reliable Wireless Backhaul (URWB)Cisco Expressway Series Cisco Expressway Select Series Cisco Product Security Incident Response TeamPublished Oct 23, 2026 22:39 UTC Read the advisory
	High	8.7	CVE-2026-115938	Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template Craft CMSCraft CMS cms, Craft CMS	NVD	Oct 23 22:16 UTC
CVE-2026-115938Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template Executive summary The advisory says that Craft CMS allows any authenticated control panel user to submit an element-search condition that is evaluated as a sandboxed Twig object template. The provided text is mostly repository page content and does not state a severity rating or a vendor-recommended fix. Defenders should check the Craft CMS security advisory and update guidance from the vendor. Technical summary The flaw is described as an injection issue in which an element selector in an element-search condition is evaluated as a sandboxed Twig object template. The attacker must be an authenticated control panel user. The advisory text does not state affected version numbers, fixed versions, a CVSS score, workarounds, exploitation status, or detection guidance. The remainder of the text is GitHub repository navigation and project description, which contains no further vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/cms Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Craft CMS cms Craft CMS NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.7	CVE-2026-115937	The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which... Craft CMS, MollieCraft CMS commerce-mollie, Mollie for Craft Commerce	NVD	Oct 23 22:16 UTC
CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which... Executive summary The advisory describes a flaw in the Mollie webhook endpoint of the Mollie for Craft Commerce plugin, where two attacker-controlled parameters are not checked to belong together. The advisory text provided is truncated and does not state how serious the flaw is or what fix the vendor recommends. Technical summary The flaw is described as a failure to verify that the commerceTransactionHash and a second independent parameter belong together on the Mollie webhook endpoint, which suggests an authorization or input validation weakness, but the vulnerability class is not explicitly named in the provided text. The attack vector and preconditions are not stated in full because the description is cut off. Affected versions are not stated, though the README mentions Mollie 4.1.x and 4.2.x compatibility with Craft 4 and 5, and no fixed version is stated. No workaround, detection guidance, CVSS score, or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/commerce-mollie Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Mollie Craft CMS commerce-mollie Mollie for Craft Commerce NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.7	CVE-2026-115935	The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place... Craft CMSCraft CMS cms, Craft CMS	NVD	Oct 23 22:16 UTC
CVE-2026-115935The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place... Executive summary The advisory says that a Craft CMS action called app/process-api-response-headers accepts fake API response headers from any authenticated control panel user, including non-admin users who only have accessCp permission. The text provided does not state a severity rating, a fixed version, or a vendor recommendation. Defenders should check the official Craft CMS security notice for those details. Technical summary The flaw is described as improper acceptance of attacker-supplied API response headers in the app/process-api-response-headers action, which suggests an input validation weakness. The attacker needs only an authenticated control panel account with the accessCp permission and no admin rights. The advisory text is truncated and does not state affected version numbers, fixed versions, CVSS score, workarounds, exploitation status, or detection guidance. Those items are not stated in the provided text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/craftcms/cms Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Craft CMS Craft CMS cms Craft CMS NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	2.1	CVE-2026-115897	Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions yahoo, Serialize JavaScriptyahoo serialize-javascript, Serialize JavaScript	NVD	Oct 23 22:16 UTC
CVE-2026-115897Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions Executive summary The advisory describes a fix in the Serialize JavaScript library, which serializes JavaScript values including regular expressions and functions. The change addresses a case where a function body ending in a script close tag could be left unescaped, which could allow a closing script tag to be formed in output. The advisory does not state a severity rating, and it does not state a specific fixed version. Technical summary The flaw concerns incomplete escaping of script close tags in serialized function bodies, which is a script-injection class issue in serialized output. The patch changes the escaping regular expression so that a bare "</script" at the very end of a function body is also neutralized, because the newline added by the space option could otherwise complete the tag in the surrounding output. The advisory includes unit tests for these cases. The advisory does not state the attack vector in detail, the preconditions beyond the use of the space option, affected version ranges, fixed version numbers, CVSS score, or any workaround. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/yahoo/serialize-javascript/c…db3e70d1a079de108a61 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects yahoo Serialize JavaScript yahoo serialize-javascript Serialize JavaScript NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	8.8	CVE-2026-115895	Happy DOM is a JavaScript implementation of a web browser without its graphical user interface capricorn86, Happy DOMcapricorn86 happy-dom, Happy DOM	NVD	Oct 23 22:16 UTC
CVE-2026-115895Happy DOM is a JavaScript implementation of a web browser without its graphical user interface Executive summary The advisory covers a fix in Happy DOM, a JavaScript browser implementation, that changes how module import aliases are handled so they are not run as executable code. The advisory text provided is a code diff and does not state a severity rating or explicitly describe an exploit impact. Vendor recommendations beyond the code change are not stated. Technical summary The diff changes ECMAScriptModuleCompiler.ts so that import alias names are validated against a Unicode-aware identifier pattern and property names are emitted through JSON.stringify rather than raw string interpolation, which the added test describes as preventing unsanitized import aliases from being interpolated as executable code. A test named for this case checks that a marker global is not set after execution. The advisory does not state a CVE description, vulnerability class label, attack vector, preconditions, affected versions, fixed versions, CVSS score, workarounds, or detection guidance. The remaining diff mostly adds public suffix list entries and CSS property mappings, which are not described as security fixes. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/capricorn86/happy-dom/commit…91f7b4e4f46d6cccbe13 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affects capricorn86 Happy DOM capricorn86 happy-dom Happy DOM NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115893	Wasmtime is a runtime for WebAssembly bytecodealliancebytecodealliance wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115893Wasmtime is a runtime for WebAssembly Executive summary The advisory describes a set of fixes in Wasmtime, a WebAssembly runtime, released as version 48.0.7. One listed fix covers a flaw where the Cranelift backend on aarch64 can jump to an incorrect target on a large WebAssembly br_table instruction, and the other items cover wasi-http header and body handling and a component model stream panic. The advisory does not state a severity rating for these issues, and the only recommended action it gives is to use the fixed release, with no other mitigation stated. Technical summary The aarch64 br_table issue is a control-flow flaw in the Cranelift code generator, where the jump table sequence could branch to an incorrect target on a large br_table instruction; the change replaces the conditional branch to the default target with a clamped index and an extra default entry in the jump table, and the diff notes this also acts as a Spectre mitigation. The advisory's attack vector, preconditions, and exploitation status are not stated. The fixed version is stated as 48.0.7 (released 2026-10-19), and the affected version range is not stated. No workaround and no detection guidance are stated, and no CVSS score is given. Other listed items are wasi-http guest-controlled content lengths and trailers, and a panic when lowering a host-created component model stream. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Bytecode Alliance Wasmtime Dropped extracted product not named in the source: Bytecode Alliance Cranelift Summarized from github.com/bytecodealliance/wasmtime/co…8c246937751a0bac5abd Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects bytecodealliance bytecodealliance wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	5.7	CVE-2026-115892	Wasmtime is a runtime for WebAssembly bytecodealliancebytecodealliance wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115892Wasmtime is a runtime for WebAssembly Executive summary The advisory is a Wasmtime release note for version 48.0.7 that lists several fixes, including one for a flaw where the Cranelift backend on aarch64 can jump to an incorrect target on a large WebAssembly br_table instruction. The advisory does not state how severe the flaw is, and it does not give a CVSS score. The release note points to the fixed release, and the vendor's recommendation is to update to the newer release. Technical summary The aarch64 flaw is a code generation issue in the Cranelift backend affecting large Wasm br_table instructions, where the emitted jump table sequence could branch to an incorrect target. The advisory's diff replaces the conditional branch to the default target with a clamp of the index into an extra default jump table entry, and it also mentions Spectre mitigation. Affected versions for this specific item are not stated explicitly, though the release notes are for 48.0.7, released 2026-10-19 according to the text. Workarounds are not stated, and no detection guidance is given. The advisory does not state whether the issue has been exploited in the wild, and it does not give a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Bytecode Alliance Wasmtime Dropped extracted product not named in the source: Bytecode Alliance Cranelift Summarized from github.com/bytecodealliance/wasmtime/co…8c246937751a0bac5abd Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Attack requirements Present Privileges required High User interaction Passive CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects bytecodealliance bytecodealliance wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Critical	9.9	CVE-2026-115889	Wasmtime is a runtime for WebAssembly bytecodealliance, Wasmtimebytecodealliance wasmtime, Wasmtime	NVD	Oct 23 22:16 UTC
CVE-2026-115889Wasmtime is a runtime for WebAssembly Executive summary The advisory is a diff of a Wasmtime source file, a WebAssembly runtime, changing how internal value data is packed in the Cranelift code generator. The text does not describe a security impact, severity rating, or recommended action from the vendor, and it does not name affected or fixed versions. Technical summary The diff changes the ValueDataPacked layout in cranelift/codegen/src/ir/dfg.rs from a packed u64 with 24-bit x and y fields to a repr(Rust, packed) struct with 32-bit x and y fields and a 16-bit flags_and_type field, and removes the encode_narrow_field and decode_narrow_field helpers. The advisory text does not state a vulnerability class, attack vector, or preconditions, and it does not state affected versions, fixed versions, workarounds, exploitation status, or a CVSS score. No detection guidance is given. The text is a code diff only, so the security impact is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/bytecodealliance/wasmtime/co…fa75cd9d03f4a438dae0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affects bytecodealliance Wasmtime bytecodealliance wasmtime Wasmtime NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	High	7.5	CVE-2026-115887	GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas graphql-hive, GraphQL Scalarsgraphql-hive graphql-scalars, GraphQL Scalars	NVD	Oct 23 22:16 UTC
CVE-2026-115887GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas Executive summary This advisory describes a performance fix in the GraphQL Scalars library, a project that provides custom GraphQL scalar types. The change addresses a regular expression in the PhoneNumber scalar that could take excessive time to process certain inputs, which is a denial-of-service style risk. The advisory does not state a severity rating, and the recommended action it gives is to use the patched code, which the changeset describes as a patch-level fix. Technical summary The fix replaces the PhoneNumber scalar regular expression in src/scalars/PhoneNumber.ts with a pattern that the change describes as matching in linear time, indicating a regular expression denial-of-service (ReDoS) issue. The advisory states the new pattern accepts exactly the same values as before. The attack vector, preconditions, and CVSS score are not stated, and no affected version range or fixed version number is stated in the text provided. No workarounds are stated. The added tests send a 31-character input of repeated digits ending in a letter and check that serialize, parseValue, and parseLiteral reject it in under 1000 milliseconds; no other detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/graphql-hive/graphql-scalars…00c00144245c74361701 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects graphql-hive GraphQL Scalars graphql-hive graphql-scalars GraphQL Scalars NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	6.5	CVE-2026-115886	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models mlflowmlflow	NVD	Oct 23 22:16 UTC
CVE-2026-115886MLflow is an open source AI engineering platform for agents, large language models, and machine learning models Executive summary The advisory is a code diff for MLflow, an open source AI engineering platform, that adds server-side checks on serialized scorer payloads. It describes the change as closing a gap where scorer data the server could execute or use to steer outbound requests was not validated when sent directly to the REST API. The advisory does not state a severity rating, and it does not state a specific vendor recommendation beyond the code change itself. Technical summary The diff adds a helper, _validate_serialized_scorer_payload, that rejects decorator scorers carrying a call_source field, since that field is executed via exec() during deserialization, and applies this check to request payloads and to scorers fetched from the store. It also adds _validate_third_party_scorer_data, which rejects non-object kwargs and gateway destination keys such as api_base at any nesting depth, because these could direct the judge's LLM client to an attacker-chosen host. The advisory does not state the vulnerability class by name, the CVSS score, the attack preconditions beyond direct REST API access, affected version ranges, fixed version numbers, workarounds, or exploitation status, and these are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/mlflow/mlflow/commit/bac30b4…d4db07ae60ab3838803f Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects mlflow mlflow NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	4.1	CVE-2026-115885	The LangGraph CLI is the official command-line interface for LangGraph langchain-ai, @langchainlangchain-ai langgraph, @langchain LangGraph CLI	NVD	Oct 23 22:16 UTC
CVE-2026-115885The LangGraph CLI is the official command-line interface for LangGraph Executive summary The advisory describes changes to the LangGraph CLI, the official command-line interface for LangGraph, shown as code diffs in a repository. The advisory text does not state how serious the issue is, what the vendor recommends, or which versions are affected. Technical summary The advisory is a copied repository diff page for the LangGraph CLI, covering changes to deploy.py, exec.py, host_backend.py, and image_reference.py, and does not name a vulnerability class in plain terms. The changes add endpoint resolution logic that derives control plane and dashboard URLs from a host URL or LangSmith endpoint, and they let callers pass a custom httpx transport. Attack vector and preconditions are not stated. Affected and fixed versions are not stated. Workarounds are not stated. Exploitation status and CVSS score are not stated. No detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/langchain-ai/langgraph/commi…3a0e9133a07ffd6a553c Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Attack requirements Present Privileges required Low User interaction Passive CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects langchain-ai @langchain langchain-ai langgraph @langchain LangGraph CLI NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Medium	6.0	CVE-2026-115883	LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents langchain-ailangchain-ai langgraph, langchain-ai langgraph-checkpoint-postgres, langchain-ai langgraph-checkpoint-sqlite	NVD	Oct 23 22:16 UTC
CVE-2026-115883LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents Executive summary The advisory describes a change to LangGraph checkpoint savers for Postgres and SQLite, which add validation of namespace labels in store operations. The advisory text does not state a severity rating, and it does not describe the change as a fix for a named exploit or give a vendor recommendation. Impact on users is not stated. Technical summary The advisory shows a code change that calls a new validate_op_namespace check on each store operation in the Postgres and SQLite store base modules, and adds tests that reject namespace labels containing dots, empty strings, or non-string values. The tests suggest the concern is that dot-joined namespaces such as ("foo.bar",) could reach the same stored location as ("foo", "bar"), but the advisory does not explicitly state a vulnerability class, CVSS score, attack vector, or preconditions. Affected versions are not stated, fixed versions are not stated, and workarounds are not stated. Exploitation status is not stated, and no detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: LangGraph LangGraph checkpoint-postgres Dropped extracted product not named in the source: LangGraph LangGraph checkpoint-sqlite Summarized from github.com/langchain-ai/langgraph/commi…2cebf8825e911b493ab1 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects langchain-ai langchain-ai langgraph langchain-ai langgraph-checkpoint-postgres langchain-ai langgraph-checkpoint-sqlite NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	1.9	CVE-2026-115801	A security flaw has been discovered in Kakao khaiii up to 0.4 KakaoKakao khaiii	NVD	Oct 23 22:16 UTC
CVE-2026-115801A security flaw has been discovered in Kakao khaiii up to 0.4 Executive summary A security flaw has been reported in Kakao khaiii, a Korean morphological analyzer, in versions up to 0.4. The advisory text provided is mostly a copy of the project's GitHub readme and does not describe the flaw, its severity, or a vendor fix. Technical summary The advisory states that a security flaw exists in Kakao khaiii up to 0.4 but gives no vulnerability class, attack vector, or preconditions. Affected and fixed versions beyond the phrase 'up to 0.4' are not stated. No CVSS score, workaround, exploitation status, or detection guidance is stated. The remaining text is repository and project documentation, not vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/kakao/khaiii Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Kakao Kakao khaiii NIST National Vulnerability DatabasePublished Oct 23, 2026 22:16 UTC Read the advisory
	Low	3.1	CVE-2026-83813	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-83813Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a fix in the Twisted framework's DNS code, in which DNS responses were not checked against the address that sent the original query. The advisory does not state a severity rating for this issue. The text provided contains only a code diff, so the vendor's recommended action beyond the code change is not stated. Technical summary The change touches the DNSDatagramProtocol class in src/twisted/names/dns.py and adds a per-message-ID record of the query's destination address. Incoming datagrams whose message ID matches a live query are now dropped unless the source address matches the stored address. This suggests the earlier weakness was a missing source-address check on DNS responses, which would be a spoofing or response-injection class issue, but the advisory does not explicitly name the vulnerability class. Attack vector, preconditions, and the affected version range are not stated. The fixed release version is not stated. Workarounds and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/b53e1…1c74cf9e48373b5879ac Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.3	CVE-2026-75525	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-75525OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary An unauthenticated remote attacker can insert an encryption key of their own choosing into the staff key directory of OpenReception's appointment booking software, so future appointments in the affected tenant get encrypted to that key as well. The advisory rates this Moderate with a CVSS 3.1 score of 5.3 and says the flaw affects versions up to and including 2.1.0. The advisory states that no patched version is available, and it does not state a workaround. Technical summary The flaw is an incorrect authorization issue (CWE-863) in the POST /api/tenants/{id}/staff/{staffId}/crypto handler, which accepts a registration write when the webauthn-registration-email cookie matches the request-body email. The cookie can be obtained without authentication by calling POST /api/auth/challenge with any email, including one that does not exist. The write is not bound to the target staff member's stored email, the tenant membership, or a signed registration session. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states that the attacker cannot retrieve ciphertext on its own because retrieval requires a valid staff session, and that the issue can be exploited only for users without an active key. No workaround is stated, and no specific detection guidance is stated. The advisory recommends requiring the signed registration-bootstrap session and binding the write to the target staff email and tenant. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/GHSA-qc72-9fg9-h66h Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.4	CVE-2026-75524	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software	NVD	Oct 23 21:17 UTC
CVE-2026-75524OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory describes a fix in OpenReception's appointment booking software, which provides an end-to-end encrypted appointment booking platform. It shows a code change that adds row locking and transactions to prevent double-booking of agents when appointments are created at the same time, but it does not state a severity rating or a CVE-specific impact in the text provided. Technical summary The advisory is a copied code diff from a commit in the appointment service, not a formal vulnerability description. The change moves the agent availability check into a database transaction and adds a SELECT ... FOR UPDATE lock on the agent row, which the code comment says is meant to avoid race conditions between concurrent appointment creations. Attack vector, preconditions, CVSS score, affected versions, fixed versions, workarounds, and exploitation status are not stated in the advisory. Vulnerability class is implied to be a race condition (likely double-booking), but the advisory does not name it explicitly. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…897dc1f494ace2f0e452 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affects open-reception open-reception appointment-booking-software NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-65825	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-65825OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary A flaw in OpenReception's appointment booking software lets one tenant disable the PIN brute-force protection that applies to a returning client in another tenant, so a six-digit booking PIN could be guessed online. The advisory rates it High with a CVSS score of 7.5 and states that no patched version is available (patched versions: None). The advisory does not state a vendor-recommended fix beyond the changes the researcher suggests. Technical summary This is an improper restriction of excessive authentication attempts (CWE-307) caused by inconsistent tenant scoping in the challenge_throttle table. The throttle row is keyed on the tenant-independent emailHash, but reads filter by tenant_id while writes never update it, so the first tenant to record a failure owns the row and other tenants see no throttle. Exploitation is over the network with no privileges or user interaction, but requires two tenants on one instance and knowledge of the victim's email. The advisory lists affected versions as <= 2.1.0 and patched versions as None. It states no workaround from the vendor, though the researcher recommends a consistent throttle key, not trusting x-forwarded-for for rate limiting, and raising PIN entropy. The advisory does not state whether the flaw has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/GHSA-v4q4-xmqf-gmq8 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.4	CVE-2026-65824	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-65824OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory describes a fix in the OpenReception appointment booking software, where an invitation token could be reused to sign up again. The advisory shows a code change that stops used invitations from being accepted and marks invites as used sooner, and it does not give a severity rating. The advisory does not state any vendor recommendation beyond the code change. Technical summary The flaw appears to be reuse of an invitation token in the user registration flow in src/lib/server/services/user-service.ts. The patch adds a check that the invite has not been used before accepting it, and moves the call that marks the invite as used so it runs regardless of the user confirmation state. The advisory does not state the vulnerability class, CVE-specific impact, attack preconditions, affected versions, fixed versions, workarounds, CVSS score, or detection guidance. The advisory does not state whether the issue has been exploited in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…c0a6deb9267bfec03622 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.3	CVE-2026-58202	OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform open-receptionopen-reception appointment-booking-software, open-reception OpenReception	NVD	Oct 23 21:17 UTC
CVE-2026-58202OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform Executive summary The advisory covers OpenReception, an end-to-end encrypted appointment booking platform. The text provided is a GitHub release page for v2.0.0 that mentions a fix for a security advisory (GHSA-w5g9-g2p4-2g4m) but does not describe the flaw's impact or severity. The advisory does not state how serious the issue is, and it does not say whether it is being exploited. Technical summary The release notes say the fix for GHSA-w5g9-g2p4-2g4m, reported by Volcore, is included in v2.0.0, but they do not name the vulnerability class, attack vector, or preconditions. The release also makes a breaking change by requiring a new MANAGEMENT_DOMAIN environment variable, which the notes say ensures security for system administration. Affected versions are not stated in the text, though the release is compared against v1.1.1 in the changelog. No CVSS score, workaround, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/open-reception/appointment-b…/releases/tag/v2.0.0 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affects open-reception open-reception appointment-booking-software open-reception OpenReception NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	5.4	CVE-2026-115877	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115877Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a request-smuggling gap in the Twisted web framework's HTTP header parsing, where a header value containing a bare carriage return or line feed could hide a following header from the parser. The advisory does not state a severity rating. The fix, as shown in the diff, makes the server reject such header values with a 400 response and close the connection. Technical summary The flaw is a request-smuggling issue in twisted.web.http.HTTPChannel.headerReceived, which accepted header values containing bare CR or LF characters that a lenient proxy could interpret differently. The diff adds a check that rejects header values containing NUL, CR, or LF with a 400 Bad Request and disconnects, citing RFC 9110 section 5.5. The advisory does not state affected version ranges, fixed version numbers, workarounds, exploitation status, or a CVSS score. Detection guidance is not stated, though the added test sends bare CR and LF header values and expects a 400 response. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/1616f…a5b22ad70fab140a7eb1 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Changed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Low	1.9	CVE-2026-115800	A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2 UbiquitousLearningUbiquitousLearning mllm	NVD	Oct 23 21:17 UTC
CVE-2026-115800A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2 Executive summary The advisory says a vulnerability was identified in UbiquitousLearning mllm, a multimodal large language model inference engine, in versions up to 2.0.2. The text provided is mostly a copy of the project's GitHub repository page and does not describe the flaw, its severity, or a vendor recommendation. Technical summary The advisory does not state the vulnerability class, attack vector, or preconditions. It names mllm versions up to 2.0.2 as affected, but no CVSS score, fixed version, workaround, or detection guidance is stated. Exploitation in the wild is not stated. The provided text is a repository README with build, model, and tool documentation, and it contains no vulnerability details. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/UbiquitousLearning/mllm Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects UbiquitousLearning UbiquitousLearning mllm NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-115778	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115778Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory covers a Twisted Telnet protocol issue where a remote peer could send a telnet subnegotiation that is never terminated, causing the server to buffer data without limit and potentially exhaust its memory. The fix caps the buffer and drops the connection when the cap is exceeded. The advisory text provided does not state a severity rating or CVSS score. Technical summary The flaw is an unbounded memory buffer (resource exhaustion) in twisted.conch.telnet.Telnet when parsing an unterminated IAC SB subnegotiation, as described in the changed code and newsfragment. The fix adds a _MAX_SUBNEGOTIATION_LENGTH cap of 4096 bytes, logs a warning, and drops the connection when the cap is exceeded, with escaped IAC IAC bytes counting toward the cap. The advisory does not state affected version ranges or a fixed release version, and does not state a CVSS score, exploitation status, or workaround. No detection guidance beyond the logged warning text is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/073ba…1abc5ae76d46eff1b529 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	7.5	CVE-2026-115776	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115776Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a fix in the Twisted Python networking framework's IRC protocol component, where a remote peer could exhaust server memory by sending data without a line delimiter. The advisory does not state a severity rating or a CVSS score. The fix adds a maximum line length that drops the connection when exceeded, and the advisory points to upgrading to the patched release. Technical summary The weakness is unbounded buffer growth in twisted.words.protocols.irc.IRC, where data without a line delimiter accumulates in memory, which is a resource exhaustion issue. A remote peer that can connect to the IRC protocol and send data without a newline can trigger it, and the advisory does not state other preconditions. The fix adds a MAX_LENGTH class attribute with a default of 16384 and calls lineLengthExceeded, which drops the connection by default. The advisory does not state affected or fixed version numbers, does not give a workaround, and does not provide detection guidance. The advisory text is a diff and does not state these items explicitly. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/01f8c…380b2ea939fa6bdbab30 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.7	CVE-2026-115775	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115775Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a change to the Twisted Python networking framework's XML stream parser in twisted.words, used for XMPP messaging, which previously let a peer exhaust server memory by sending an unbounded stanza. The fix adds per-stanza size and element-count limits. The advisory does not state a severity rating or CVSS score, and it does not give affected or fixed version numbers. Technical summary The weakness is unbounded resource consumption (memory exhaustion) in the domish XML element streams of twisted.words.xish, which parse XMPP stanzas from a peer. The advisory's diff adds maxStanzaSize and maxElementCount limits to SuxElementStream and ExpatElementStream, raising ParserError when exceeded, with counters reset when a stanza is emitted. The attack vector is a remote peer sending a large or unbounded stanza; no authentication requirement is stated. Affected and fixed version numbers are not stated, and no workaround is stated. Exploitation status and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/88738…ad4d2c4d64039beb88b0 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Medium	4.9	CVE-2026-115774	Twisted is an event-based framework for internet applications, supporting Python 3.6+ twistedtwisted	NVD	Oct 23 21:17 UTC
CVE-2026-115774Twisted is an event-based framework for internet applications, supporting Python 3.6+ Executive summary The advisory describes a flaw in the Twisted framework's IMAP mail server component, where an authenticated client could send a crafted SEARCH command that freezes the server. The advisory does not state a severity rating or CVSS score. The fix rejects literals with a negative octet count, and the advisory gives no workaround beyond applying the code change. Technical summary The flaw is a denial-of-service condition in the parseNestedParens function of twisted.mail.imap4, where a literal with a negative octet count causes the parser to loop without terminating. The attacker must be an authenticated IMAP client sending a crafted SEARCH command. The fix adds a check that raises ValueError with the message "Illegal literal size" when the literal size is less than zero, and a unit test named test_literalNegativeSize was added. The advisory does not state affected version numbers, fixed version numbers, a CVSS score, or any workaround. Exploitation in the wild and detection guidance are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/twisted/twisted/commit/3d125…97f480bb699a5e074741 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Affects twisted twisted NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-113951	If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf AppleApple Container	NVD	Oct 23 21:17 UTC
CVE-2026-113951If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf Executive summary The apple/container project's K8s plugin can let content from an untrusted Linux container run commands on the macOS host. The advisory rates this as High severity, and the vendor's recommendation is to upgrade apple/container to version 1.5.0, which contains the fix. Technical summary The flaw is an unfiltered merge of a cluster container's kubeconfig into the host kubeconfig, which lets an attacker who can write to /etc/kubernetes/admin.conf inside the cluster container plant an exec credential plugin that kubectl runs as the macOS host user. The advisory says the trigger is a later write-config or create --node-image run, and the attacker needs prior write access to the cluster container's filesystem through a compromised workload, a hostPath mount, or a tampered node image. Affected versions are stated as less than 1.5.0, with 1.5.0 as the patched version. The advisory states no CWE, no CVSS score, and no information on exploitation in the wild. Detection guidance is given as running kubectl config view --raw to check whether any cluster-related user has a non-empty exec or auth-provider entry. Workarounds are avoiding write-config against untrusted clusters and avoiding create --node-image with untrusted node images. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/apple/container/security/adv…/GHSA-44v5-vx46-ghv6 Score No CVSS score published. Affects Apple Apple Container NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	Unknown	n/a	CVE-2026-113877	HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each... Robert RothenbergRobert Rothenberg HTTP::Headers::ActionPack	NVD	Oct 23 21:17 UTC
CVE-2026-113877HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. _language_match interpolates each... Executive summary HTTP::Headers::ActionPack for Perl, before version 0.10, can be forced to use excessive CPU by a crafted Accept-Language header. The advisory says the fix changes language matching so header values are compared as plain text instead of regular expressions. The advisory does not state a severity rating, and the fix is in the code change shown. Technical summary The flaw is classed as CPU exhaustion caused by treating Accept-Language range values as unescaped regular expressions, which is a regular expression denial-of-service issue. The advisory states that versions before 0.10 are affected and that the attacker can submit crafted Accept-Language headers, with no authentication described in the text. The patch replaces the regex match in _language_match with a case-insensitive exact, wildcard, or prefix comparison using substr, and adds a timing test. The fixed version is stated as 0.10 in the affected-version line, and the Changes entry is under an unreleased heading, so the released version number is not otherwise stated. No workaround is stated, no CVSS score is stated, and no detection guidance or exploitation status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/robrwo/perl-HTTP-Headers-Act…2750e0f0f4bec9.patch Score No CVSS score published. Affects Robert Rothenberg Robert Rothenberg HTTP::Headers::ActionPack NIST National Vulnerability DatabasePublished Oct 23, 2026 21:17 UTC Read the advisory
	High	8.8	CVE-2026-79982	The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79982The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/device_next/class/bt_hci.c, copies every controller-to-host HCI packet into a USB transfer buffer... Executive summary A flaw in the Bluetooth HCI USB transport class of the new USB device stack can let a nearby attacker overflow a memory buffer on affected devices. The advisory says it can cause a remote crash, and on production builds without memory protection it can potentially lead to arbitrary code execution. The advisory does not state a fixed version, and the fix described is a separate, larger buffer pool for the controller-to-host direction. Technical summary This is a buffer overflow (CWE class not stated) in subsys/usb/device_next/class/bt_hci.c, where HCI packets are copied into fixed 64-byte USB pool slots with no length check via net_buf_add_mem(). Attack preconditions include a Bluetooth-range attacker, with a connected peer using Data Length Extension or broadcasting extended advertising data, and the advisory notes the overflow is also reached on every host initialization in the stock configuration through a 70-byte Read Supported Commands event. With CONFIG_ASSERT=n and CONFIG_NET_BUF_HARDENING disabled, memory corruption may occur; with assertions enabled, the device panics. The advisory describes a fix that adds a bt_hci_tx_pool sized to MAX(BT_BUF_ACL_RX_SIZE, BT_BUF_EVT_RX_SIZE). Affected and fixed version numbers are not stated, and no workaround or detection guidance is stated beyond the configuration options discussed. CVSS score and exploitation status are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Zephyr Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	6.5	CVE-2026-79981	The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() ->... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79981The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised (dns_resolve_init_locked() ->... Executive summary The advisory says the DNS stub resolver in an embedded networking stack reuses one source UDP port for all queries, which lets an attacker on the same network segment or with UDP reachability to the device race forged DNS replies and make an application resolve an attacker-chosen address. The advisory describes the flaw as allowing redirection of name resolution, but it does not state a severity score. The fix randomizes the source port per query, and the advisory describes it as controlled by a configuration option that defaults to enabled. Technical summary The flaw is a weak-randomness issue in DNS query matching, where the resolver keeps a constant UDP source port for its lifetime so only the 16-bit transaction identifier varies, contrary to RFC 5452 section 9.2. The advisory says the reply source address is never checked, so forged replies need only reach the resolver's port and win a race against the legitimate server. Preconditions are UDP reachability to the device, such as the same LAN or a globally routable address, and winning the race during a query window; the advisory notes TLS certificate validation largely protects applications. Affected versions are not stated, and no fixed version is given; the fix is described as dns_randomize_source_port() with CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT defaulting to y. No workaround beyond that configuration is stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	5.6	CVE-2026-79980	The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79980The DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c maintained its transaction identifier (iface->config.dhcpv4.xid) as a counter rather than as a per-transaction random value Executive summary The DHCPv4 client in Zephyr's networking subsystem can be fooled by forged DHCP replies because its transaction identifier is predictable and reused. The advisory says an attacker on the same network, or a DHCP server the device previously joined, could redirect the device's default gateway and DNS resolvers. The advisory does not state a severity score; the vendor fix changes how the identifier is generated. Technical summary The flaw is a predictable transaction identifier (xid) in the DHCPv4 client in subsys/net/lib/dhcpv4/dhcpv4.c, which is treated as a counter instead of a fresh random value per transaction, so an observed xid stays valid for the device's uptime. The attack requires only that the attacker learn one xid, for example by seeing the broadcast DHCPDISCOVER, since the reply checks cover op, xid and chaddr (public MAC) and the UDP callback accepts any remote address and port. A single accepted forged reply can change the default gateway and DNS resolvers through option processing that runs before the state gate, and a forged DHCPACK or DHCPNAK can alter the lease during RENEWING or REBINDING. The advisory states the fixed version is not stated, no workaround is stated, and no detection guidance is stated; the fix draws fresh sys_rand32_get() values when transactions begin. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Project Zephyr Impact if exploited ConfidentialityLow IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.8	CVE-2026-79979	The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79979The arm64 MMU backend invalidates a single virtual address from the TLB with invalidate_tlb_page() in arch/arm64/core/mmu.c, which issued TLBI VAE1{IS} with an operand of virt... Executive summary The advisory describes a flaw in the arm64 memory management code of a system that uses memory domains and demand paging. An unprivileged user thread could keep access to a physical memory page after it was reclaimed and reused, potentially reading or changing kernel data or other threads' memory. The advisory does not state a severity score, and the fix is a code change that switches the cache invalidation instruction to one that clears all matching entries. Technical summary The root cause is that invalidate_tlb_page() issued a TLBI VAE1 operation with an operand that encoded only ASID 0, so stale non-global translations for user memory domains were not removed when a demand-paged frame was evicted. This is a stale translation (use-after-reclaim) class issue, reachable from unprivileged code in a user thread that drives memory pressure to force eviction. Preconditions are an arm64 build with CONFIG_USERSPACE and CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain. The fix uses TLBI VAAE1{IS}, and the advisory also stops globalize_table() from stripping EL0 permissions during paging synchronization. Affected and fixed version numbers are not stated, and no workaround is stated. No detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	3.6	CVE-2026-79978	The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len... zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79978The RTIO streaming completion callback adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c clamps the amount of FIFO data it will report (read_len... Executive summary A flaw in the Zephyr-style ADXL345 accelerometer streaming driver can cause the driver to write sensor data past the end of a memory buffer when the buffer pool is short on space. The advisory says the result is silent corruption of other data or a crash, and it is reached only through local conditions on boards with this sensor and streaming enabled. The advisory does not state a fix or a vendor recommendation. Technical summary This is an out-of-bounds write (buffer overflow) in adxl345_process_fifo_samples_cb() in drivers/sensor/adi/adxl345/adxl345_stream.c, where the number of queued 6-byte FIFO reads is bounded by the device entry count rather than the clamped buffer length, writing up to 186 bytes past an undersized allocation. A second defect leaves data->fifo_total_bytes unreset at batch start, so a stale offset after an aborted chain can cause further out-of-bounds writes. Preconditions are an interrupt-wired ADXL345, CONFIG_ADXL345_STREAM enabled, and RTIO block pool starvation or fragmentation, which can be induced by a co-resident local workload. The advisory states there is no network, USB or radio attack path. Affected and fixed version numbers are not stated, and no workaround or detection guidance is given. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Zephyr Project Zephyr Dropped extracted product not named in the source: Analog Devices ADXL345 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	8.2	CVE-2026-79977	The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate zephyrprojectzephyrproject zephyr	NVD	Oct 23 20:17 UTC
CVE-2026-79977The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate Executive summary The advisory says the WireGuard VPN service in subsys/net/lib/wireguard/wg.c can be made to send tunnel traffic to an address chosen by an attacker, because it accepts an unauthenticated message and updates the peer endpoint from it. A single spoofed UDP packet sent to the default port 51820 can persistently break the tunnel and let an attacker sit in its path, though the advisory states that encryption still prevents decryption or forgery of content. The advisory does not state a severity score, and it describes a fix that stops learning endpoints from unauthenticated messages. Technical summary The flaw is classified as the update of a peer endpoint from an unauthenticated message. In handle_transport_data(), a transport-data message whose 32-bit receiver index matches no session causes a new handshake to be scheduled and the datagram source address to be copied into peer->endpoint with memcpy. The listener has no remote address or port filter and defaults to UDP port 51820, so an off-path host can send a 16-byte spoofed datagram, and the vulnerable branch runs when the peer has no valid handshake or current keypair, such as at boot or after a session expires. The advisory states that the impact is loss of availability and limited confidentiality of metadata, not key compromise. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is stated. The advisory describes the fix as keeping stale-session recovery while sending handshakes only to an endpoint learned from an authenticated message or the configured cfg_endpoint, and it notes CONFIG_WIREGUARD is marked experimental and not enabled by default. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Affects zephyrproject zephyrproject zephyr NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.5	CVE-2026-19741	Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig,... zephyrproject, Zephyr, OpenThreadzephyrproject zephyr, Zephyr, OpenThread	NVD	Oct 23 20:17 UTC
CVE-2026-19741Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with default "J01NME" in modules/openthread/Kconfig.thread (previously subsys/net/l2/openthread/Kconfig,... Executive summary The advisory says Zephyr's OpenThread integration shipped a publicly known default joining credential, "J01NME", that could let an unauthenticated attacker within radio range take over commissioning of an uncommissioned device. The advisory describes the consequence as a device joining an attacker-controlled network and remaining mis-provisioned until reset. The fix removes the default and requires a per-device credential, and the advisory recommends provisioning a unique credential per device from factory data. The advisory does not state a severity score. Technical summary This is a use of a hardcoded or publicly known default credential (CONFIG_OPENTHREAD_JOINER_PSKD defaulting to "J01NME") in the Thread commissioning handshake. The attack requires an attacker within 802.15.4 radio range of an uncommissioned device, such as one that is factory-fresh, freshly reset, or had its settings erased, and that is built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd. The attacker can run a stock commissioner with that credential, complete the DTLS-PSK handshake, and supply a malicious operational dataset. The advisory states the option is not enabled by default and no in-tree sample uses the vulnerable combination. Affected and fixed version numbers are not stated, and no CVSS score, workaround beyond overriding the PSKd, or detection guidance is stated. The fix adds a BUILD_ASSERT() requiring a 6-to-32-character PSKd when joiner autostart is enabled. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects zephyrproject Zephyr OpenThread zephyrproject zephyr Zephyr OpenThread NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	2.9	CVE-2026-115797	A weakness has been identified in Tenda F6 12.02.01.73 TendaTenda F6	NVD	Oct 23 20:17 UTC
CVE-2026-115797A weakness has been identified in Tenda F6 12.02.01.73 From the advisory A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the component Web Management Interface. Executing a manipulation of the argument ecos_pw can lead to cleartext transmission of sensitive information. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity High Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tenda Tenda F6 NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Low	2.1	CVE-2026-115796	A security flaw has been discovered in Tenda F6 12.02.01.73 TendaTenda F6, Tenda F6 (N300) Wireless Router	NVD	Oct 23 20:17 UTC
CVE-2026-115796A security flaw has been discovered in Tenda F6 12.02.01.73 Executive summary A security flaw in the Tenda F6 (N300) wireless router firmware V12.02.01.73 lets an attacker who tricks a logged-in administrator into opening a malicious web page perform administrative actions on the router, such as a factory reset, reboot, or password change. The advisory rates it High with a CVSS 3.1 base score of 8.0 and says the vendor had not responded when the report was written. The advisory does not state a vendor fix or recommended update; it lists remediation steps for the vendor to implement. Technical summary The flaw is a cross-site request forgery (CWE-352) in the router's web management interface, which accepts state-changing POST requests to /goform/ endpoints without anti-CSRF tokens or SameSite cookie restrictions. The attack requires an authenticated administrator to open an attacker-controlled page while on the device's network; the advisory gives a CVSS vector of AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Affected version is stated as Firmware V12.02.01.73 (Hardware V5.0), and the latest version at disclosure is stated as V12.02.02.77, which the researchers did not test. The advisory does not state a fixed version, and it does not state any workaround beyond the vendor remediation steps (anti-CSRF tokens, SameSite cookies, re-authentication for sensitive actions, and removing the recoverable Wi-Fi password from configuration downloads). Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/0xWKZER/tenda-f6-vulnerabili…blob/main/01-csrf.md Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tenda Tenda F6 Tenda F6 (N300) Wireless Router NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115586	virtualenv is a tool for creating isolated virtual python environments pypa, virtualenvpypa virtualenv, virtualenv	NVD	Oct 23 20:17 UTC
CVE-2026-115586virtualenv is a tool for creating isolated virtual python environments Executive summary The advisory is a set of code changes to the virtualenv Python tool, adding CodeQL security queries and related fixes, which points to link-following and shell-quoting weaknesses in virtualenv. The advisory does not state a severity rating for a specific vulnerability, and it does not give a clear description of the impact on users. Technical summary The text shows a diff that adds CodeQL queries for possible flaws: permission changes inside shutil.rmtree error handlers (CWE-732), writes that follow a link at the destination (CWE-59), unsafe quoting in activator scripts (CWE-116), and unquoted shebangs (CWE-78). It also updates a changelog entry for issue 3466 and a threat model document. The advisory does not state affected versions, fixed versions, CVSS score, attack preconditions for a specific CVE, workarounds, or whether any of these issues is exploited in the wild. The text does not explicitly confirm that a vulnerability was fixed, so these details are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/pypa/virtualenv/commit/3598e…6b2347a8a919ac03c5f4 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required None User interaction Active CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects pypa virtualenv pypa virtualenv virtualenv NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115585	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115585pypdf is a free and open-source pure-python PDF library Executive summary This advisory is a code diff for pypdf, a open-source Python PDF library, and it shows performance-related changes to how the library reads PDF files. The advisory does not state a severity rating or describe a security impact, and it does not name a fixed release. Technical summary The diff changes pypdf's object lookup and cross-reference table recovery so that a new helper, get_stream_data, reads the whole stream instead of repeating the same code, and it adds a cache check keyed on object generation and number. The added tests measure speed for repeated invalid object lookups and for large cross-reference tables, which suggests the underlying issue is excessive processing time on crafted input. The advisory does not state the vulnerability class, attack vector, preconditions, affected versions, fixed versions, workarounds, or exploitation status, and it does not describe any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115580	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115580pypdf is a free and open-source pure-python PDF library Executive summary The advisory describes a flaw in pypdf, a free open-source Python library for reading PDF files. The text provided contains only a code diff and no severity rating, so the advisory does not state how serious the issue is or what the vendor recommends. Technical summary The diff changes how pypdf reads the size declared in a standard cross-reference table, adding a check that rejects a declared size larger than the stream length divided by 20 and raises LimitReachedError. The change suggests a resource-exhaustion or malformed-input issue, but the advisory does not explicitly state the vulnerability class, attack vector, or preconditions. Affected version ranges are not stated, and no fixed version number is stated. No workaround and no exploitation status are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/a3061e34…20f5f049c53cfb1482b2 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	High	7.1	CVE-2026-115572	pypdf is a free and open-source pure-python PDF library py-pdfpy-pdf pypdf	NVD	Oct 23 20:17 UTC
CVE-2026-115572pypdf is a free and open-source pure-python PDF library Executive summary This advisory shows source code changes to pypdf, a free open-source Python PDF library, that appear to address performance problems when repeatedly looking up invalid PDF objects and reading cross-reference tables. The advisory text does not state a severity rating or describe an exploitable security impact. It does not state any vendor recommendation or fixed version. Technical summary The advisory is a diff of commits to pypdf, with new tests named for speed and caching of repeated invalid object lookups and standard xref table reads. The changes add a get_stream_data helper in _utils.py, change the cache check in get_object in _reader.py, and rename a parameter in _doc_common.py. The advisory does not state a vulnerability class, CVSS score, attack vector, preconditions, affected versions, fixed versions, workarounds, or detection guidance. The tests reference earlier run times of about 25 seconds, which suggests a performance issue, but the advisory does not explicitly call it a security vulnerability. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/py-pdf/pypdf/commit/68a0e504…a21a713f3c7fbde18b4b Impact if exploited ConfidentialityNone IntegrityNone AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects py-pdf py-pdf pypdf NIST National Vulnerability DatabasePublished Oct 23, 2026 20:17 UTC Read the advisory
	Medium	6.8	RHSA-2026:88779	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Red Hat Enterprise Linux Server - Extended Life Cycle Support 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7, Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 19:53 UTC
RHSA-2026:88779CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a security update for the ca-certificates package on Red Hat Enterprise Linux 7 Extended Lifecycle Support systems across x86_64, IBM z Systems, and IBM Power platforms. Red Hat rates the update as Critical and says it distrusts eMudhra intermediate CA certificates due to security concerns. Red Hat recommends applying the updated ca-certificates package. Technical summary The flaw is tracked as CVE-2026-114406 and is fixed by distrusting eMudhra intermediate CA certificates in the ca-certificates package, which contains Mozilla-selected CA certificates used for Internet PKI. The advisory does not describe the specific vulnerability class, attack vector, or preconditions for exploitation. The fixed package version is ca-certificates-2026.2.92_v9.0.319-70.3.el7_9, and the advisory lists no workarounds. No CVSS score is given in the text itself, and it is not stated whether the issue is exploited in the wild. The advisory provides no detection guidance beyond the package update and a link to the Red Hat article on applying updates. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88779 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 19:53 UTC Read the advisory
	Medium	6.8	RHSA-2026:88562	ca-certificates security update Red Hat, MozillaRed Hat Enterprise Linux, Mozilla ca-certificates	Red Hat Security Advisories	Oct 23 19:43 UTC
RHSA-2026:88562CVE-2026-114406ca-certificates security update Executive summary This Red Hat advisory covers a critical update to the ca-certificates package on Red Hat Enterprise Linux 9.2 systems, including several Update Services and Extended Life Cycle variants. The update distrusts eMudhra intermediate Certificate Authority certificates because of security concerns, and Red Hat rates it Critical. Red Hat recommends applying the ca-certificates update described in the advisory on affected systems. Technical summary The flaw is tracked as CVE-2026-114406 and is described as a decision to distrust eMudhra intermediate CA certificates due to security concerns, so the vulnerability class is not stated beyond that. The advisory does not describe the attack vector, exploitation preconditions, or whether exploitation has occurred. The fixed package is ca-certificates-2026.2.92_v9.0.319-90.3.el9_2 for the listed RHEL 9.2 variants. The advisory does not state a CVSS score in the text provided, and it refers readers to the CVE page for it. No workaround is stated, and no detection guidance is stated beyond applying the update per the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88562 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects Red Hat Mozilla Red Hat Enterprise Linux Mozilla ca-certificates Red Hat Product SecurityPublished Oct 23, 2026 19:43 UTC Read the advisory
	High	8.1	RHSA-2026:88835	php:8.2 security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 19:39 UTC
RHSA-2026:88835CVE-2026-109618CVE-2026-109619php:8.2 security update Executive summary Red Hat published advisory RHSA-2026:88835, an Important-rated security update for the php:8.2 module on Red Hat Enterprise Linux 9.4 systems covered by Update Services for SAP Solutions, Extended Life Cycle, AUS, and related subscriptions. The advisory describes two PHP flaws, one of which it says can lead to remote code execution, and the vendor recommends applying the updated packages. The advisory does not state how many systems are affected in practice or whether exploitation has been observed. Technical summary The two issues are CVE-2026-109618, a memory corruption and remote code execution flaw caused by an out-of-memory bailout during request parsing, and CVE-2026-109619, a use-after-free caused by fatal error handling that keeps stale request state. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. The fixed package version is php-8.2.13-1.module+el9.4.0+25177+88c847cf.4 for the affected PHP packages, as listed in the advisory. Workarounds are not stated, and no detection guidance is given beyond applying the update per the linked Red Hat article. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88835 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 19:39 UTC Read the advisory
	High	8.1	RHSA-2026:88834	php:8.2 security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 19:29 UTC
RHSA-2026:88834CVE-2026-109618CVE-2026-109619php:8.2 security update Executive summary Red Hat advisory RHSA-2026:88834 provides a php:8.2 security update for Red Hat Enterprise Linux 9.6 Extended Update Support and related channels. Red Hat rates it as Important and fixes two PHP vulnerabilities, CVE-2026-109618 (memory corruption leading to remote code execution) and CVE-2026-109619 (use-after-free). The advisory recommends applying the updated php packages. Technical summary The two flaws are a memory corruption issue triggered by out-of-memory bailout during request parsing, which the advisory says can lead to remote code execution, and a use-after-free caused by fatal error handling that retains stale request state. The advisory does not state the attack vector or preconditions beyond these descriptions, and it does not give a CVSS score in the text provided, referring readers to the CVE pages. Fixed package versions are listed as php-8.2.28-1.module+el9.6.0+25176+d8415d54.4 and related module packages, with the update applied through the articles referenced in the Solution section. No workarounds are stated, and no detection guidance or exploitation-in-the-wild information is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88834 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 19:29 UTC Read the advisory
	High	8.5	CVE-2026-91093	A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary... HPHP One Agent Software, HP One Agent	NVD	Oct 23 19:17 UTC
CVE-2026-91093A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary... Executive summary A potential security vulnerability has been identified in HP One Agent, which runs on certain HP PC products. The advisory says it might allow an attacker to gain higher privileges or run arbitrary code. HP is releasing software updates to mitigate the issue. Technical summary The advisory describes a potential privilege escalation and arbitrary code execution vulnerability in HP One Agent. The vulnerability class, attack vector, and preconditions are not stated. Affected versions are not stated, and fixed versions are not stated beyond HP releasing software updates. Workarounds are not stated. No detection guidance is given, and exploitation status and CVSS score are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Local Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects HP HP One Agent Software HP One Agent NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	Medium	5.3	CVE-2026-115845	An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code... AWSAWS MCP Server	NVD	Oct 23 19:17 UTC
CVE-2026-115845An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code... Executive summary A weakness in the Python code validator of the run_script tool in AWS MCP Server could let an authenticated user run arbitrary code inside their own isolated session. The advisory says AWS has already fixed the issue on its side and no customer action is required. Technical summary The flaw is an incomplete list of disallowed inputs in the Python code validator of the run_script sandbox, which is a validation bypass that could allow arbitrary code execution. An authenticated remote user could exploit it with a crafted script, and the advisory says the code would run only within their own isolated session environment. The advisory states the fix was applied service-side. Affected versions are given as N/A because the service is managed and exclusively hosted. No fixed version number is stated because the fix is service-side, and no CVSS score, exploitation status, or detection guidance is stated. Per the advisory, no workaround is needed if run_script is used only to run Python scripts that make AWS API calls. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: Amazon Web Services AWS MCP Server Summarized from aws.amazon.com/security/security-bulletins/2026-149-aws Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS AWS MCP Server NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.4	CVE-2026-115570	Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS electron, Node.js, Chromiumelectron, Node.js, Chromium	NVD	Oct 23 19:17 UTC
CVE-2026-115570Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS Executive summary The advisory is a commit diff for Electron, a framework for building desktop applications, and it adds a certificate blocklist that treats certificate chains containing certain public keys as revoked. The advisory does not describe a vulnerability by name, does not state a severity rating, and does not give a CVSS score. Its text does not include a vendor recommendation beyond the patch itself. Technical summary The change adds SHA-256 public key hash (SPKI) blocklist entries to Chromium's network code and to Node.js TLS, using a wrapped X509_verify_cert callback that reports X509_V_ERR_CERT_REVOKED when a blocked key appears in a chain or in peer-sent certificates. The advisory does not state a vulnerability class, a CVE-specific description, attack vector, or preconditions for exploitation. Affected and fixed versions are not stated, and no workaround is described beyond the patches themselves. The advisory does not state whether exploitation has occurred in the wild, and it gives no detection guidance beyond the test specification that checks for CERT_REVOKED results. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/electron/electron/commit/093…6e225137bf2af755fbcc Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects electron Node.js Chromium electron Node.js Chromium NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	Low	3.3	CVE-2026-115569	Fallow is a codebase intelligence tool for TypeScript and JavaScript fallow-rs, @fallow-cli, Fallowfallow-rs fallow, @fallow-cli fallow-node, fallow-rs fallow-cli, fallow-rs fallow-core, Fallow	NVD	Oct 23 19:17 UTC
CVE-2026-115569Fallow is a codebase intelligence tool for TypeScript and JavaScript Executive summary Fallow, a codebase analysis tool for TypeScript and JavaScript, had a flaw that let its Jest and Vitest project settings read config files located outside the project folder. The advisory describes this as a security issue but does not state a severity score, and the fix is included in the project's changes shown in the advisory. Technical summary The flaw is a path containment issue (reading files outside the intended root) in how Fallow resolves Jest projects entries, Vitest test.projects entries, Vitest inline project extends paths, and script --config paths. Preconditions include a project config that names an absolute path, a path with dot segments, a glob, or a symlink pointing outside the project root. The fix adds canonicalization-based checks so only files inside the project root are read, and glob base paths outside the root are skipped; the advisory's diff also adds a Jest glob escaping fix for directory names containing square brackets. Affected and fixed version numbers are not stated in the advisory, and no CVSS score is stated. No workarounds or detection guidance are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/fallow-rs/fallow/commit/75c0…e65b446343989f4c5649 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Affects fallow-rs @fallow-cli Fallow fallow-rs fallow @fallow-cli fallow-node fallow-rs fallow-cli fallow-rs fallow-core Fallow NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.1	CVE-2026-112342	Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based... Tandoor RecipesTandoor Recipes	NVD	Oct 23 19:17 UTC
CVE-2026-112342Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based... Executive summary The advisory states that Tandoor Recipes before 2.7.0 contains a flaw that lets authenticated users keep stale group-based access after permissions change. The text is cut off, so the full impact is not stated. The advisory does not state a severity score, and no vendor recommendation beyond upgrading to 2.7.0 or later is clearly stated in the excerpt. Technical summary The flaw is described as an improper cache-key design in cookbook/helper/permission_helper.py that lets authenticated users retain stale group-based permissions. The diff changes the cache key from user primary key alone to include the space primary key, and moves recipe permission checks into a shared helper, with related checks added to the serializer. The affected version is stated as before 2.7.0; the exact fixed version is stated only as 2.7.0 in the description. No CVSS score, workaround, exploitation status, or detection guidance is stated in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/TandoorRecipes/recipes/commi…658849eed5686294d5e9 Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tandoor Recipes Tandoor Recipes NIST National Vulnerability DatabasePublished Oct 23, 2026 19:17 UTC Read the advisory
	High	7.6	CVE-2026-115863	ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message ConnManConnMan	NVD	Oct 23 18:17 UTC
CVE-2026-115863ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message Executive summary The advisory says ConnMan through version 2.0 contains a stack-based buffer overflow that can be triggered by a DHCPv6 Reply message. The provided text is mainly a 2013 git commit that adds domain search list parsing to the DHCPv6 client, and it does not state a severity rating or a vendor recommendation. Technical summary The flaw is described as a stack-based buffer overflow, triggered through a DHCPv6 Reply message handled by the gdhcp client code. The quoted commit adds a get_domains function in gdhcp/client.c that copies data into a fixed-size stack buffer (char dns_name[NS_MAXDNAME + 1]) using strncpy with a length of NS_MAXDNAME and then walks the value buffer using length bytes taken from the packet. The advisory does not state the attack vector details beyond a DHCPv6 Reply message, the required network position, or whether authentication is needed. Affected versions are stated only as through 2.0, and no fixed version is stated. No workaround, CVSS score, exploitation status, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from git.kernel.org/pub/scm/network/connman/…4fb4b03fe2a12420d280 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityHigh How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H Affects ConnMan ConnMan NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Medium	6.9	CVE-2026-115813	Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal... AWS, Amazon Web ServicesAWS multi-model-server, Amazon Web Services Multi Model Server	NVD	Oct 23 18:17 UTC
CVE-2026-115813Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to send requests to internal... Executive summary Amazon Web Services Multi Model Server (MMS), an open source tool for serving machine learning models, has two issues affecting all released versions up to and including 1.1.11, and the advisory describes the one for CVE-2026-115813 as allowing the management interface to be directed to make requests to unintended network destinations. The advisory does not give a severity score, but the bulletin is labeled Important and notes that the management interface needs no authentication, so exposed deployments are at higher risk. MMS is end of life with no fixed version, so the vendor recommends migrating to a supported model-serving solution. Technical summary CVE-2026-115813 is a server-side request forgery flaw in the model download path, where the unauthenticated MMS management interface can be made to send requests to unintended network destinations. The advisory says deployments that bind the management interface to a network-accessible address are at increased risk. Affected versions are stated as <=1.1.11 (all released versions). No fixed version is available or planned, so the advisory provides no fixed version. The workaround is to bind the management interface to the loopback address when inference and management use separate ports, and to avoid passing externally supplied URLs to the model-download path; the advisory notes this is not available in SageMaker-style deployments, where management shares the inference port. The advisory does not state any detection guidance, CVSS score, or evidence of exploitation in the wild. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from aws.amazon.com/security/security-bulletins/2026-148-aws Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS Amazon Web Services AWS multi-model-server Amazon Web Services Multi Model Server NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Critical	9.3	CVE-2026-115812	Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a... AWS, Amazon Web ServicesAWS multi-model-server, Amazon Web Services Multi Model Server	NVD	Oct 23 18:17 UTC
CVE-2026-115812Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a... Executive summary Amazon Web Services Multi Model Server (MMS) versions 1.1.11 and earlier have two issues that could let an attacker run code or reach unintended network destinations. The advisory says MMS has reached end of life, no fixed version is available, and AWS recommends migrating to a supported model-serving solution. Technical summary CVE-2026-115812 is a relative path traversal in model archive extraction, letting a crafted archive write files outside the intended directory and potentially execute code with the MMS process privileges. CVE-2026-115813 is an issue in the model download path that could let the management interface make requests to unintended network destinations (server-side request forgery class). The management interface does not require authentication, and risk is increased when it is bound to a network-accessible address. Affected versions are stated as <=1.1.11 (all released versions); no fixed version is available or planned. The advisory gives workarounds: bind the management interface to loopback on separate ports and avoid passing external URLs to the download path, but notes this is not available in every configuration, such as the SageMaker-style deployment where management shares the inference port. No detection guidance or exploitation-in-the-wild status is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from aws.amazon.com/security/security-bulletins/2026-148-aws Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects AWS Amazon Web Services AWS multi-model-server Amazon Web Services Multi Model Server NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	Medium	5.8	CVE-2026-115567	Tokio is a runtime for writing applications with Rust tokio-rs, Tokiotokio-rs tokio, Tokio	NVD	Oct 23 18:17 UTC
CVE-2026-115567Tokio is a runtime for writing applications with Rust Executive summary This advisory is a NIST NVD entry for CVE-2026-115567 and describes a code change to the Tokio runtime for Rust, which is a library for writing asynchronous applications. The advisory text does not state the severity, a CVSS score, or the impact of the change, and it does not name a fixed release. The vendor's recommended action is not stated in the text provided. Technical summary The text shows a diff to Tokio's timer code that changes how timer entries hold a reference to the runtime handle, moving the handle into TimerEntry and adding a drop implementation that cancels the entry. It does not state the vulnerability class, the attack vector or preconditions, or any CVE description. Affected versions, fixed versions, workarounds, and detection guidance are not stated in the advisory. Exploitation status and a CVSS score are also not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/tokio-rs/tokio/commit/2b4eba…f3e5f4a97ff4f6fa28d0 Impact if exploited ConfidentialityNone IntegrityLow AvailabilityHigh How it is exploited Attack vector Local Attack complexity High Attack requirements Present Privileges required Low User interaction None CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects tokio-rs Tokio tokio-rs tokio Tokio NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	High	7.4	CVE-2026-110975	A flaw was found in Kruize Autotune KruizeKruize Autotune	NVD	Oct 23 18:17 UTC
CVE-2026-110975A flaw was found in Kruize Autotune Executive summary Kruize Autotune exposed the stored login secrets for its monitoring data sources, including passwords, tokens, API keys, and OAuth2 client secrets, to any client that can reach the service. Anyone who could reach the service could take these credentials and reuse them against the backing monitoring systems. The advisory says the fix is in Autotune 0.11.2, which removes the secrets from the affected responses and tightens the CORS policy. Technical summary The flaw is an information exposure caused by serializing datasource objects with default Gson settings and no field exclusion, classified as CWE-256 (Plaintext Storage of a Password) in the advisory's references. The REST API has no authentication layer, so any client with network access to the service can call GET /datasources or the datasource-metadata endpoint and read cleartext credentials. The advisory states that the NodePort, LoadBalancer, and OpenShift Route configurations make the service remotely reachable. The issue is fixed in Autotune 0.11.2 by a Gson exclusion strategy on AuthenticationConfig and a deny-by-default CORS handler. The advisory states that credentials stored in cleartext at rest in the kruize_authentication table are not addressed by this fix. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/security/cve/CVE-2026-110975 Impact if exploited ConfidentialityHigh IntegrityNone AvailabilityNone How it is exploited Attack vector Adjacent network Attack complexity Low Privileges required None User interaction None Scope Changed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Affects Kruize Kruize Autotune NIST National Vulnerability DatabasePublished Oct 23, 2026 18:17 UTC Read the advisory
	High	8.3	CVE-2026-87901	Improper sanitization in the registration module allows reflected Cross-Site Scripting. phpBBphpBB	NVD	Oct 23 17:17 UTC
CVE-2026-87901Improper sanitization in the registration module allows reflected Cross-Site Scripting. Executive summary A flaw in the registration module of an unnamed product allows reflected cross-site scripting, which lets an attacker run scripts in a user's browser. The advisory does not state a severity score or a vendor recommendation. Technical summary The vulnerability class is reflected cross-site scripting caused by improper input sanitization in the registration module. The advisory does not state the attack vector details beyond the reflected nature of the flaw, and it does not state the preconditions for exploitation, such as whether user interaction is required. Affected product names and versions are not stated. Fixed versions are not stated. Workarounds are not stated. Detection guidance is not stated. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Affects phpBB phpBB NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.3	CVE-2026-115810	Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to... Tandoor RecipesTandoor Recipes recipes, Tandoor Recipes	NVD	Oct 23 17:17 UTC
CVE-2026-115810Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privileged users to force the server to... Executive summary Tandoor Recipes versions before 2.7.0 contain a server-side request forgery flaw in the Pestle importer. Authenticated users with low privileges could make the server send requests to destinations they choose. The advisory's release notes say the issue was fixed in version 2.7.0, and the advisory text does not state a severity rating. Technical summary The flaw is a server-side request forgery (SSRF) in the Pestle importer, reachable by authenticated low-privileged users. The advisory text is truncated, so the full attack details, exact preconditions beyond authentication, and any CVSS score are not stated. The release notes for 2.7.0 list a fix for the pestle importer SSRF issue under GHSA-xq7g-9q95-vjc6, and the fix is in version 2.7.0, so upgrading to 2.7.0 or later is the remedy stated. No workaround or detection guidance is stated in the advisory text. Exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/TandoorRecipes/recipes/releases/tag/2.7.0 Impact if exploited ConfidentialityNone IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Tandoor Recipes Tandoor Recipes recipes Tandoor Recipes NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	4.8	CVE-2026-106074	A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land... Executive summary This advisory covers many security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a Brotli decoder flaw the advisory says could lead to remote code execution. The advisory rates the highest severity issue as HIGH and says updated versions are available, with releases on or shortly after October 21, 2026. Users should upgrade to the fixed Node.js versions listed (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include DNS name truncation at NUL bytes, TLS hostname verification bypasses involving non-canonical IPv4 spellings and fullwidth digits, a Brotli decoder out-of-bounds write (CVE-2026-111497) that the advisory says can lead to remote code execution, keep-alive socket response confusion, predictable entropy caches in startup snapshots and SEAs, a ZipFile read after failed header validation, a Permission Model wildcard over-grant, and a Permission Model bypass through fs.realpathSync. Attack preconditions are described per issue, such as a certificate issued by a CA trusted by the client and a platform resolver like glibc for one TLS issue, or malformed Brotli input supplied to node:zlib. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, and the advisory does not state which specific versions are affected for each issue beyond the release lines named. Workarounds are not stated, and no detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.3	CVE-2026-106073	A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106073A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks Executive summary This advisory covers multiple security flaws in Node.js across the 26.x, 24.x, and 22.x release lines, including issues that could let attackers bypass permission controls, spoof TLS certificate identities, or potentially run code through the Brotli decompressor. The advisory rates the highest severity issue as HIGH and says the Node.js project will release fixed versions on or shortly after October 21, 2026. Users should upgrade to the updated Node.js releases listed in the advisory (v22.23.4, v24.22.1, v26.12.1). Technical summary The flaws include a NUL byte truncation in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, an out-of-bounds write in the bundled Brotli decoder that the advisory says can lead to remote code execution, a keep-alive socket response-injection issue, a crypto entropy cache saved into snapshots, a ZipFile prefix-bytes issue, a wildcard radix lookup over-grant in the Permission Model, and a fs.realpathSync permission bypass. Attack preconditions are described per issue, such as an application resolving attacker-influenced hostnames, a certificate issued by a trusted CA for numeric DNS SANs, or a permission model with restricted --allow-fs-read. The fixed versions are listed as v22.23.4, v24.22.1, and v26.12.1, but the advisory does not state which specific version fixes each individual issue. Workarounds and detection guidance for these issues are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Local Attack complexity Low Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.7	CVE-2026-106072	A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106072A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4... Executive summary This advisory covers CVE-2026-106072, a flaw in Node.js TLS hostname verification that can let a certificate meant for a DNS name be accepted for certain IP address spellings. The advisory rates the highest severity in this release as HIGH and covers several other Node.js issues in the same security release, but it does not give a severity for CVE-2026-106072 itself, which is listed as medium. The recommended action is to upgrade to the fixed Node.js releases named in the advisory, Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The flaw is improper certificate validation in tls.checkServerIdentity(): non-canonical IPv4 spellings such as 0177.0.0.1, 0x7f.0.0.1, 2130706433 and 127.1 are not treated as IP addresses, so a certificate with only a numeric DNS SAN can authenticate an IP endpoint. Exploitation requires a certificate with a numeric DNS SAN issued by a CA the client trusts, and a platform resolver that accepts these spellings, such as glibc. The advisory says affected versions are Node.js 26.x, 24.x and 22.x, and gives fixed versions as Node.js v22.23.4, v24.22.1 and v26.12.1. No workaround is stated in the advisory, and no detection guidance is stated for this CVE. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.6	CVE-2026-106071	A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite, The Node.js Project Node.js	NVD	Oct 23 17:17 UTC
CVE-2026-106071A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the... Executive summary This advisory covers a low-severity flaw in the Node.js Permission Model, which is meant to restrict file access for Node.js programs. The flaw affects Node.js 26.x and can let code read files outside a wildcard read rule, such as reading /etc/passwd when only /etc/passwd.* is granted. The advisory rates it LOW and points users to the Node.js 26.x security release, Node.js v26.12.1, which is listed alongside the other fixes. Technical summary The flaw is in Node.js Permission Model filesystem enforcement, where the radix tree lookup for wildcard --allow-fs-read or --allow-fs-write rules stops comparing early when the requested path is shorter than the grant prefix, so the path is treated as a match. The advisory says it requires a wildcard grant sitting directly under the root of the permission tree, for example when it is the only grant for that scope, and that the attacker needs code running under --permission. It affects Node.js 26.x only. The advisory does not state a fixed version specifically for this CVE, though it lists Node.js v26.12.1 as the release for the 26.x line. No workaround, exploitation status, CVSS score, or detection guidance is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite The Node.js Project OpenSSL undici Node.js node c-ares SQLite The Node.js Project Node.js NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Low	3.7	CVE-2026-106070	A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite, Brotli	NVD	Oct 23 17:17 UTC
CVE-2026-106070A flaw in the Node.js `zlib.ZipFile` API can cause it to return bytes that do not belong to the requested entry after the local and central header validation fails. When... Executive summary This advisory covers a batch of security flaws in Node.js across its 26.x, 24.x, and 22.x release lines, including a high-severity Brotli decoder memory corruption issue that the advisory says could lead to remote code execution. The Node.js Project recommends updating to the fixed releases it names (v22.23.4, v24.22.1, v26.12.1) on or shortly after October 21, 2026, since end-of-life versions are always affected. Technical summary The advisory describes several vulnerability classes: an out-of-bounds write in the Brotli decoder (CVE-2026-111497, high) triggered by malformed compressed input passed to node:zlib, DNS name truncation at NUL bytes, TLS hostname verification bypasses for non-canonical IPv4 forms, HTTP keep-alive response confusion, entropy cache reuse in snapshots, ZipFile returning wrong bytes after header validation failure (26.x only), and Permission Model bypasses via wildcard matching and fs.realpathSync. Fixed versions are given as v22.23.4, v24.22.1, and v26.12.1. Workarounds are not stated in the advisory, and no CVSS scores or evidence of in-the-wild exploitation are stated. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityNone IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Affects OpenSSL undici Node.js c-ares SQLite Brotli OpenSSL undici Node.js node Node.js c-ares SQLite Brotli NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-106069	A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-106069A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is... Executive summary This advisory covers a Node.js security release addressing many flaws across the 26.x, 24.x, and 22.x release lines, with the CVE-2026-106069 issue being a TLS hostname verification flaw that can validate a server certificate against a different IP address than the one connected to. The advisory states the highest severity fixed in each release line is HIGH, and the vendor recommends upgrading to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1 on or shortly after October 21, 2026. Fixed versions for the specific CVE are as stated in the release notes; end-of-life versions are noted as always affected. Technical summary CVE-2026-106069 is a TLS hostname verification flaw in tls.checkServerIdentity() where a non-canonical IPv4 literal with a leading zero, such as 0127.0.0.1, is normalized as octal by WHATWG URL rules while the OS resolver reads it as decimal, so a certificate for another IP may be accepted; the advisory notes this occurs on some platforms such as macOS. It affects Node.js 26.x, 24.x, and 22.x, and the advisory states the fix is in the listed releases v22.23.4, v24.22.1, and v26.12.1. The advisory does not state any workaround for this CVE, and it does not state whether exploitation has occurred in the wild. The advisory does not give a CVSS score for this CVE and does not provide specific detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105483	A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105483A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with... Executive summary This advisory covers a set of security fixes in Node.js releases for the 26.x, 24.x, and 22.x lines, which the advisory says are scheduled for October 21, 2026. The advisory rates the highest severity issue as HIGH and recommends upgrading to the fixed releases, Node.js v22.23.4, v24.22.1, or v26.12.1, since end-of-life versions are always affected by security releases. Technical summary The fixes cover several classes of flaws: TLS hostname verification bypasses for non-canonical or non-ASCII IPv4 spellings (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), DNS name truncation at NUL bytes (CVE-2026-105482), HTTP keep-alive response confusion (CVE-2026-105481), and Permission Model bypasses via fs.realpathSync and wildcard grants (CVE-2026-106073, CVE-2026-106071). Entropy cache leakage into snapshots and SEAs (CVE-2026-106074) and ZIP prefix byte disclosure (CVE-2026-106070) are also addressed. The advisory does not state workarounds for these issues. Detection guidance is not stated. Dependency updates to c-ares, OpenSSL, SQLite, Undici, and a CA certificate list are also included, with the affected release lines given for each. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Dropped extracted product not named in the source: OpenJS Foundation Node.js Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	7.4	CVE-2026-105482	A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse() Executive summary This Node.js security release covers multiple flaws in the 26.x, 24.x and 22.x release lines, including several rated high severity, such as DNS name truncation, TLS hostname bypasses, and a Brotli decoder out-of-bounds write that the advisory says can lead to remote code execution. The advisory recommends updating to the fixed releases Node.js v22.23.4, v24.22.1, or v26.12.1, which are stated as available on or shortly after October 21, 2026. Commercial support for versions past Maintenance LTS is noted as available through OpenJS partners. Technical summary The advisory describes several vulnerability classes: DNS name truncation at NUL bytes (CVE-2026-105482), TLS hostname verification bypasses for fullwidth-digit and leading-zero or non-canonical IPv4 hosts (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072), an out-of-bounds write in the Brotli decoder that the advisory says can lead to a crash, memory disclosure, or remote code execution when an application decompresses attacker-supplied data with node:zlib (CVE-2026-111497), HTTP keep-alive response confusion, entropy cache leakage into snapshots and SEAs, ZIP header validation bypass, Permission Model wildcard over-grant, and a Permission Model bypass via fs.realpathSync. Affected versions are given per issue, and the fixed versions are listed as Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory does not state workarounds for any issue, and it does not give CVSS scores or exploitation-in-the-wild status. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite eMudhra OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	Medium	6.5	CVE-2026-105481	A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request OpenSSL, undici, Node.jsOpenSSL, undici, Node.js node, Node.js, c-ares, SQLite	NVD	Oct 23 17:17 UTC
CVE-2026-105481A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the client has sent the request Executive summary This advisory covers a set of security fixes in Node.js release lines 26.x, 24.x, and 22.x, with several issues the advisory rates as high severity. The highest severity issue fixed in each release line is HIGH, and the advisory says End-of-Life versions are always affected when a security release occurs. The vendor recommends upgrading to the patched releases Node.js v22.23.4, v24.22.1, or v26.12.1, which the advisory says will be available on or shortly after October 21, 2026. Technical summary The issues include DNS name truncation at a NUL byte in dns.resolve*() and dns.reverse(), TLS hostname verification bypasses for non-canonical and fullwidth IPv4 spellings, a Brotli decoder out-of-bounds write that the advisory says can lead to a crash, memory disclosure, or remote code execution, a keep-alive HTTP socket issue that accepts a response sent before the request, crypto entropy cache reuse in startup snapshots and SEAs, a zlib.ZipFile header validation bypass, and Permission Model filesystem bypasses via wildcard rules and fs.realpathSync. Affected versions are listed per issue, and the fixed versions are Node.js v22.23.4, v24.22.1, and v26.12.1. The advisory also lists dependency updates to c-ares, ca-cert, OpenSSL, SQLite, and Undici. Workarounds and detection guidance are not stated in the advisory. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nodejs.org/en/blog/vulnerability/octobe…26-security-releases Impact if exploited ConfidentialityLow IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N Affects OpenSSL undici Node.js c-ares SQLite OpenSSL undici Node.js node Node.js c-ares SQLite NIST National Vulnerability DatabasePublished Oct 23, 2026 17:17 UTC Read the advisory
	High	8.7	CVE-2026-57845	Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle... Hugging Face, pandasHugging Face datasets, pandas	NVD	Oct 23 16:16 UTC
CVE-2026-57845Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python code by crafting a malicious pickle... Executive summary Hugging Face datasets versions up to and including 5.1.0 contain an insecure deserialization flaw in the deprecated pandas packaged builder. An attacker who gets a victim to load a malicious pickle-backed dataset can run arbitrary Python code with the victim process's privileges, and the advisory rates this High with a CVSS 3.1 base score of 8.8. The advisory describes a narrow code change that blocks the pickle path as the remediation, and it notes that no confirmed fixed release is documented. Technical summary This is CWE-502, deserialization of untrusted data, in the pandas packaged builder, where Pandas._generate_tables() passes an opened file to pandas.read_pickle() before Arrow conversion. The attack vector is network with low complexity, no privileges, and user interaction required (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the victim must load the attacker's dataset through load_dataset("pandas", data_files=...). Affected versions are stated as all Hugging Face datasets versions <= 5.1.0. The advisory says a confirmed fixed release is not documented, so the fixed version is not stated. The proposed remediation is an unconditional error in _generate_tables() before any file is opened, with migration to Parquet, Arrow, CSV, JSON, or Dataset.from_pandas(); the advisory notes existing installed packages must be patched or replaced separately. Detection guidance beyond the included proof-of-concept marker-file behavior is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/SaiTeja-Erukude/CVE-2026-57845-hf-datasets-rce Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects Hugging Face pandas Hugging Face datasets pandas NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-52356	An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting... D-LinkD-Link DAP1160L	NVD	Oct 23 16:16 UTC
CVE-2026-52356An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execute arbitrary commands via injecting... Executive summary An OS command injection flaw affects the D-Link DAP1160L A1_FW101WWb04 device. The advisory describes it as allowing attackers to run arbitrary commands, but the excerpt provided does not state a severity rating. The advisory does not state a vendor fix or upgrade recommendation in the text provided. Technical summary The flaw is an OS command injection in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04, which lets attackers execute arbitrary commands by injecting input. The advisory text is truncated, so the attack vector and authentication preconditions are not stated. Fixed firmware versions are not stated. Workarounds are not stated. CVSS score is not stated. Detection guidance is not stated. The D-Link bulletin text provided is generic boilerplate and gives no specific remediation steps. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from dlink.com/en/security-bulletin Score No CVSS score published. Affects D-Link D-Link DAP1160L NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2026-50787	e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php e-SIC Livree-SIC Livre esiclivre	NVD	Oct 23 16:16 UTC
CVE-2026-50787e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php Executive summary The e-SIC Livre (esiclivre) application, in version v0.2.2 and earlier, has a CAPTCHA component that can be made to use excessive server resources. An unauthenticated remote attacker could cause slowdowns, errors, or denial of service. The advisory does not state a severity score, and it says no upstream fix was available when the CVE was assigned, so it recommends applying local input validation and resource limits until a fix is released. Technical summary This is an uncontrolled resource consumption flaw (CWE class not stated) in restrito/inc/captcha.php. The GET parameters l, a, tf, and ql set CAPTCHA width, height, font size, and character count, and they are passed to GD image creation and text rendering without upper bounds. The endpoint is remotely reachable with no authentication, and the advisory says exhaustion can cause memory and CPU spikes, timeouts, and HTTP 5xx responses. Affected versions are v0.2.2 and earlier, up to and including commit 0a72b4c9ab89244ec3bd3d7fa0b765850cc9afd7; no fixed version is stated because no upstream fix was available. The advisory recommends integer conversion, min and max bounds, fixed dimensions, character limits, PHP memory and time limits, rate limiting, and freeing image resources. No detection guidance or CVSS score is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/brynax/CVE-2026-50787 Score No CVSS score published. Affects e-SIC Livre e-SIC Livre esiclivre NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	Unknown	n/a	CVE-2025-45528	An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF Nitro Software, IncNitro Software, Inc Nitro PDF Pro	NVD	Oct 23 16:16 UTC
CVE-2025-45528An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF Executive summary The advisory says Nitro PDF Pro for macOS version 14.7 has an issue that lets a local attacker run arbitrary code by opening a crafted PDF. The advisory does not state a severity rating, and it does not describe a vendor fix or recommended action. The rest of the page text is unrelated boat dealer website content. Technical summary The advisory describes an issue that allows arbitrary code execution through a crafted PDF, which suggests a memory or input handling flaw, but the specific weakness class is not stated. The attack requires a local attacker and a victim to open the crafted file, as the text indicates local access. Affected version is given as v.14.7 for Nitro PDF Pro on macOS. Fixed versions, workarounds, CVSS score, and detection guidance are not stated. The remaining advisory text is unrelated boat dealer web page content and contains no technical detail. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from nitro.com Score No CVSS score published. Affects Nitro Software, Inc Nitro Software, Inc Nitro PDF Pro NIST National Vulnerability DatabasePublished Oct 23, 2026 16:16 UTC Read the advisory
	High	8.1	RHSA-2026:88720	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 15:23 UTC
RHSA-2026:88720CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for PHP on Red Hat Enterprise Linux 9.6 Extended Update Support and related subscriptions. The advisory rates it Important and fixes two flaws, one that the advisory says can lead to memory corruption and remote code execution. Technical summary The advisory describes CVE-2026-109618, an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, where fatal error handling retains stale request state leading to use-after-free. The advisory does not state the attack vector, required preconditions, or CVSS scores, and refers readers to the CVE pages for those details. Affected PHP package versions are listed as php-8.0.30-3.el9_6.2 on RHEL 9.6 variants, and the fixed package is the same build. No workarounds are stated, and no detection guidance or evidence of exploitation in the wild is stated. Administrators are directed to the Red Hat article at https://access.redhat.com/articles/11258 for update instructions. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88720 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 15:23 UTC Read the advisory
	High	8.1	RHSA-2026:88725	php security update Red Hat, PHPRed Hat Enterprise Linux, PHP	Red Hat Security Advisories	Oct 23 15:23 UTC
RHSA-2026:88725CVE-2026-109618CVE-2026-109619php security update Executive summary Red Hat has released a security update for PHP on Red Hat Enterprise Linux 9.4 systems covered by several update and life cycle programs. It fixes two vulnerabilities that Red Hat rates as Important, one of which the advisory says can lead to remote code execution. The advisory says to apply the updated php packages as described in the linked Red Hat article. Technical summary The advisory describes two PHP flaws: CVE-2026-109618, an out-of-memory bailout during request parsing that leads to memory corruption and remote code execution, and CVE-2026-109619, where fatal error handling retains stale request state and causes a use-after-free. The advisory does not state the attack vector, required preconditions, or any authentication requirement in detail, and it does not give a CVSS score in the text provided. The fixed package version is php-8.0.30-1.el9_4.2, but the advisory does not state the affected (pre-fix) versions. No workarounds, mitigations, or detection guidance are stated, and exploitation in the wild is not stated. Defenders should apply the listed updated packages. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from access.redhat.com/errata/RHSA-2026:88725 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affects Red Hat PHP Red Hat Enterprise Linux PHP Red Hat Product SecurityPublished Oct 23, 2026 15:23 UTC Read the advisory
	High	8.6	CVE-2026-58497	Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP olo-dot-io, ZenAlexaolo-dot-io Uni-CLI, ZenAlexa @zenalexa/unicli	NVD	Oct 23 15:17 UTC
CVE-2026-58497Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP Executive summary Uni-CLI, a command interface tool for websites, browsers, desktop applications, and MCP, has a flaw in its legacy HTTP MCP transport that let a malicious web page reach a local Uni-CLI server when the user had started that transport. The advisory rates the issue High severity. The vendor recommends upgrading to version 0.225.2 or later, or avoiding browser-originated traffic to the legacy HTTP MCP transport until the upgrade is possible. Technical summary The weakness is an origin validation error (CWE-346) combined with cross-site request forgery (CWE-352). The legacy stateless HTTP MCP path on loopback did not check browser Origin headers before routing, so a web page could send a CORS simple POST with text/plain content to the local /mcp endpoint and drive tools/call requests. The precondition is that the user has started the local MCP HTTP transport. Affected versions are stated as less than 0.225.2, and the patched version is 0.225.2, which moves the Origin policy into a shared guard and rejects non-loopback browser Origins with HTTP 403. The advisory states the workaround as avoiding exposure of the legacy HTTP transport to browser traffic and using stdio or Streamable HTTP instead. No detection guidance and no CVSS score are stated, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/olo-dot-io/Uni-CLI/security/…/GHSA-v3f4-w7r7-v3hm Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required None User interaction Passive CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects olo-dot-io ZenAlexa olo-dot-io Uni-CLI ZenAlexa @zenalexa/unicli NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.3	CVE-2026-55486	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55486The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application's IIIF authorization code, where unvalidated origin values could be reflected into a script block. The text does not state a severity rating, affected version range, or fixed version, and it does not give a clear recommended action beyond the code change shown. Technical summary The change adds strict validation of the origin parameter against a pattern for scheme://host[:port] and rejects invalid values with HTTP 400 in the login and token services. It also adds an escaping function for origin values written into a JavaScript string inside a script tag in the token service response, which suggests a script injection or breakout weakness, though the advisory text does not explicitly name a vulnerability class, CVE-specific attack vector, or required preconditions. Affected versions are not stated, fixed versions are not stated, and no workaround or detection guidance is provided in the advisory text. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…7dfe3958ad2bbcff2d0b Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction Required Scope Changed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55465	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55465The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a set of code changes to the Goobi viewer, a web application for displaying digitised material. The changes address several issues, including Solr query injection risks on the spatial search endpoint and a deprecated token-in-URL authentication path. The advisory text does not state a severity rating, and it does not say whether these changes correspond to a specific exploitable vulnerability with a CVSS score. Technical summary The diff shows several hardening changes: a deprecated fallback that accepts the web API token as a URL query parameter (logged as a warning, removal planned on or after 2027-05-28), input validation on the solrField and region parameters of the spatial search endpoint to block Solr query syntax, and passing filterQuery through SolrTools.cleanUpQuery to strip Solr local-params. The buildClearCacheUrl method was changed to stop placing the token in the URL and the caller now sends it as a header. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, or a CVSS score. No workaround or detection guidance beyond the WARN log message is stated. The commit references GVC-2026-17 and GVC-2026-20, which the advisory does not further describe. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…c387e5a0d0d3875bf633 Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.5	CVE-2026-55463	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55463The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a change to the Goobi viewer web application that adds origin checks and authorization checks to several WebSocket endpoints, which are the parts of the software that handle live connections from browsers. The advisory does not state a severity rating, a CVSS score, or whether the issue has been exploited. The vendor's recommendation is not stated in the text provided. Technical summary The advisory is a code diff rather than a conventional vulnerability description, and it does not state a vulnerability class, CVSS score, or affected or fixed version numbers. The changes add an Origin header check (intended to guard against cross-site WebSocket hijacking) that is off by default and enabled through a new configuration setting, and add user authentication and campaign permission checks to WebSocket endpoints such as CampaignEndpoint, DownloadTaskEndpoint, LogViewerEndpoint, and UserEndpoint. The advisory does not state the attack vector, the preconditions for exploitation, or any workaround beyond enabling the new setting. It does not state the affected versions, the fixed versions, or any detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…4a1ee6753de65cbe3412 Impact if exploited ConfidentialityLow IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.4	CVE-2026-55459	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55459The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application's OpenID login handling, where the login token checks were not strict enough. The advisory does not state a severity rating or any exploitation details, and it does not name a fixed release version. Technical summary The change addresses weak validation of OpenID Connect ID tokens in the authentication endpoint. The previous code compared the nonce only when present and checked the audience claim outside the token verifier, which allowed possible cross-relying-party token replay. The patch passes the client ID into verifyOpenIdToken, requires audience, exp and iat claims to be present, adds a 60 second acceptance leeway, and rejects missing session or token nonces. The advisory does not state the vulnerability class by name, the CVSS score, affected or fixed version numbers, workarounds, or detection guidance, and these are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…d21644592efd6cf87933 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	7.4	CVE-2026-55457	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55457The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a change to the Goobi viewer, a web application for displaying digitised material, that fixes how REST API access is authorized. The text provided is a code diff rather than a full vulnerability description, so the severity and impact are not stated. The advisory does not state a vendor recommendation beyond the code change itself. Technical summary The diff changes the AuthorizationFilter checkPermissions method so that when the configured webapi.authorization.token is blank, REST API access is rejected, and blank supplied tokens are rejected before comparison. The comparison still uses MessageDigest.isEqual for constant-time comparison. The advisory does not name a CVE-specific vulnerability class, attack vector, affected version range, fixed version number, CVSS score, workaround, or exploitation status. Those details are not stated in the provided text. The diff adds unit tests covering empty tokens and empty configured tokens, but gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b440871b50181f04716d Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55444	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55444The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a flaw in the Goobi viewer web application, a tool for displaying digitised material in a browser, in its RSS feed handling. The text is a code diff of a fix to the RssResolver servlet, and it does not state how severe the issue is or give a CVSS score. The change is presented as a fix, and the advisory does not state any version numbers or other steps for administrators. Technical summary The diff suggests the weakness is an access-control bypass in the RSS servlet, where access-condition text was concatenated onto the user query so boolean operators in the q parameter could make the access restriction optional. The fix passes the access suffix as a separate filter query instead. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, workarounds, or any detection guidance. Those details are not stated in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…ea236be0d86e08948f6b Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-55442	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-55442The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material in a browser. The flaw concerns how search query strings are cleaned up, which could let crafted input change search behaviour and return far more records than intended. The advisory text shown does not state a severity rating or a fixed release version. Technical summary The change rewrites the cleanUpQuery method in SolrTools.java to replace a greedy brace-stripping regex with a placeholder-based approach that keeps a whitelist of internal Solr local parameters (join and terms) and strips other brace-delimited blocks, including double-wrapped injections. The prior regex is described as stripping inner closing braces and producing a near-match-all query that returned roughly the entire index. The vulnerability class appears to be Solr query injection through local parameters; the attack vector and preconditions are not explicitly stated in the advisory text. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is given. Added unit tests cover stripping of single and double brace local parameters, graph and function query injection, and retention of the terms parameter. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…a46b98bb9b6a88748a4e Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.1	CVE-2026-55222	Isar is an integration system for automated root filesystem generation ilbers, Isarilbers isar, Isar	NVD	Oct 23 15:17 UTC
CVE-2026-55222Isar is an integration system for automated root filesystem generation Executive summary Isar, a tool that builds Linux root filesystems, has a flaw where the apt trusted GPG key directory is owned by the user running Isar instead of root. An unprivileged user inside the built image whose ID matches that calling user could alter or add trusted keys, which could weaken apt repository integrity protection. The advisory rates it Moderate with a CVSS 3.1 base score of 5.1 and recommends applying the patch or manually changing the directory owner to root. Technical summary The weakness is improper ownership of the /etc/apt/trusted.gpg.d directory, which is created during bootstrap and owned by the calling user rather than root, so this is a local integrity issue (CVSS vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Exploitation requires that the calling user's ID match an unprivileged user in the image, and the advisory states an attacker would also need to manipulate a remote repository or intercept non-secure communication with it. The issue has no impact on images using an immutable rootfs or where apt is never invoked. Affected versions are stated as >= 0.11, and the patch is identified as commit 29e84ed301c8 ('[PATCH] mmdebstrap: ensure apt keystore is owned by root'); a fixed release version is not stated. The workaround is to chown the directory to root:root in the setup step, as shown in the provided diff. No CWEs are listed, and detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/ilbers/isar/security/advisor…/GHSA-rq66-pfw5-whqq Impact if exploited ConfidentialityNone IntegrityHigh AvailabilityNone How it is exploited Attack vector Local Attack complexity High Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Affects ilbers Isar ilbers isar Isar NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	High	8.7	CVE-2026-54668	Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite kitodokitodo-production	NVD	Oct 23 15:17 UTC
CVE-2026-54668Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite Executive summary The advisory covers Kitodo.Production, a workflow management tool for mass digitization that is part of the Kitodo Digital Library Suite. The provided text describes release 3.9.2, a bugfix release that updates dependencies to fix potential security issues, and it does not state a severity rating for any specific vulnerability. Technical summary The advisory text names CVE-2026-54668 only in its header and does not describe the vulnerability class, attack vector, or preconditions. The release notes for Kitodo.Production 3.9.2 include a change that hardens XMLUtils EAD/XML upload parsers against XXE (XML external entity) attacks, which suggests the issue may relate to XML parsing, but the advisory does not explicitly link this change to the CVE. Affected versions are not stated beyond the 3.9.2 release context, and no fixed version is explicitly labeled for this CVE. No workaround, CVSS score, exploitation status, or detection guidance is stated. The release notes also say no database schema changes were made in 3.9.2, so no SQL migration is needed when updating from a previous 3.9 release. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/kitodo/kitodo-production/rel…odo-production-3.9.2 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Attack requirements None Privileges required Low User interaction None CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects kitodo kitodo-production NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.9	CVE-2026-53942	Conda Organization Infrastructure is a centralized location for infrastructure codes condaconda infrastructure	NVD	Oct 23 15:17 UTC
CVE-2026-53942Conda Organization Infrastructure is a centralized location for infrastructure codes Executive summary The advisory describes a change to the update workflow file in the Conda Organization Infrastructure repository, which is a central location for infrastructure code. The text does not state how serious the issue is, which systems are affected, or what the vendor recommends beyond the diff shown. Technical summary The advisory text is a GitHub diff of a workflow file (.github/workflows/update.yml) that removes an issue_comment trigger and related steps that responded to '@conda-bot render' and '@conda-bot recreate' comments on pull requests. The diff does not describe a vulnerability class, attack vector, or preconditions. Affected and fixed version information is not stated. Workarounds are not stated. Exploitation status is not stated, and no CVSS score or detection guidance is given. The advisory does not name a specific security flaw in the text provided. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/conda/infrastructure/commit/…b3ad6bf0dd6f9974be55 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required Low User interaction None Scope Changed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Affects conda conda infrastructure NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.3	CVE-2026-49442	Cacti is an open source performance and fault management framework Cacti, phpseclibcacti, phpseclib	NVD	Oct 23 15:17 UTC
CVE-2026-49442Cacti is an open source performance and fault management framework Executive summary The advisory is a diff of the Cacti project changelog and auth code, and it names several security fixes for the Cacti network monitoring framework. It does not state a severity rating or a single headline impact for CVE-2026-49442 itself, and the vendor's recommended action is not stated. Technical summary The diff lists several Cacti fixes, including a SQL injection in automation_tree_rules.php tied to CVE-2026-46531, a path traversal in Reports format_file, a package signature validation bypass, and a pre-auth open redirect via link.php Referer header. The advisory does not describe which of these is CVE-2026-49442, nor state the attack preconditions, affected versions, fixed versions, workarounds, CVSS scores, or detection guidance. The diff also changes a login error message in lib/auth.php from 'Login failed' to 'Login Failed' and adds a user enumeration entry, but no details about exploitability are given. Affected and fixed version numbers are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Cacti/cacti/commit/ab4baf338…d97d1e2a310fe0af0e3e Impact if exploited ConfidentialityLow IntegrityNone AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affects Cacti phpseclib cacti phpseclib NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.8	CVE-2026-46652	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46652The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application for externally downloaded files and resource URLs. The diff adds checks that block non-HTTP(S) schemes and private network addresses, which addresses a server-side request forgery style risk. The advisory text does not state a severity rating, and it does not explicitly describe a vendor recommendation beyond the code change. Technical summary The changes add scheme validation (only http and https are accepted) and a call to NetTools.validateOutboundUrl before downloads and existence checks in ExternalFilesDownloader, which points to an SSRF class of issue. Attack preconditions, the exact vulnerability description, and affected versions are not stated in the text. Fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is provided. The diff also gates external resource URL templates behind a new externalResource[@enabled] configuration flag and includes a filename sanitization change for Content-Disposition headers. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Critical	9.8	CVE-2026-46651	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46651The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer web application that addresses server-side request forgery in its external file download feature, where the application could be made to fetch resources from unintended addresses. The advisory's diff shows changes to restrict download schemes and block private network addresses, but it does not state a severity rating. The advisory does not state what version contains the fix or give a recommendation beyond the code changes shown. Technical summary The diff indicates the flaw relates to server-side request forgery in the external file downloader, which previously accepted file scheme URIs and did not appear to validate destination addresses. The patch restricts downloads to http and https, calls a NetTools outbound URL validation that rejects private network addresses, and builds HTTP clients through a URL-aware helper. The advisory's text does not state the attack vector details, preconditions, affected version ranges, fixed version numbers, CVSS score, workarounds, or exploitation status, and these are not stated. The diff also changes a configuration check so external resource URL templates are only used when the externalResource enabled setting is true, and it removes a pom.xml SNAPSHOT dependency version. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5 Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityHigh How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	5.5	CVE-2026-46531	Cacti is an open source performance and fault management framework Cacticacti	NVD	Oct 23 15:17 UTC
CVE-2026-46531Cacti is an open source performance and fault management framework Executive summary The advisory describes a flaw in Cacti, an open source performance and fault management framework, in its automation tree rule handling that could allow a stored value to be used in database queries. The advisory text does not state a severity rating or a CVSS score. The fix shown in the pull request adds column allowlist checks, and the advisory does not describe a separate vendor recommendation beyond applying that change. Technical summary The flaw is a second-order SQL injection: the 'field' parameter of automation tree rule items was saved without an allowlist check and later concatenated into SELECT queries in create_all_header_nodes. The advisory indicates the attacker needs to be able to create or store a tree rule item, and a crafted import or duplication path was also discussed. The change adds api_automation_column_exists() checks at save time, at query build time, and in import, duplication, and build_rule_item_filter paths. The advisory does not state affected or fixed version numbers, and does not state any workaround. It also does not state whether the issue has been exploited in the wild. Detection guidance is not stated beyond a log message for skipped invalid items. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Cacti/cacti/pull/7163 Impact if exploited ConfidentialityHigh IntegrityLow AvailabilityNone How it is exploited Attack vector Network Attack complexity Low Privileges required High User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N Affects Cacti cacti NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.8	CVE-2026-46347	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46347The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a flaw in the Goobi viewer, a web application for displaying digitised material in a browser. The diff shows the password reset process previously generated reset tokens and new passwords from the system time, which could be predictable. The advisory text does not state a severity rating, and it does not state a vendor recommendation beyond the code change shown. Technical summary The fix replaces predictable password reset values, previously derived from System.currentTimeMillis() through StringTools.generateHash, with values from java.security.SecureRandom in UserBean.java. The activation key used for password reset is now 32 random bytes hex encoded, and the new password is now 4 random bytes hex encoded, which is 8 hex characters. The vulnerability class, attack preconditions, CVSS score, affected version range, fixed version number, workarounds, and exploitation status are not stated in the advisory. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef Impact if exploited ConfidentialityHigh IntegrityHigh AvailabilityNone How it is exploited Attack vector Network Attack complexity High Privileges required None User interaction Required Scope Unchanged CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory
	Medium	6.5	CVE-2026-46346	The Goobi viewer is a web application that allows digitised material to be displayed in a web browser intranda, Goobiintranda goobi-viewer-core, Goobi viewer	NVD	Oct 23 15:17 UTC
CVE-2026-46346The Goobi viewer is a web application that allows digitised material to be displayed in a web browser Executive summary The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material, where password reset tokens and new passwords were generated from the system time. The text is a code diff and does not state a severity rating or a vulnerability description, and it does not state a CVSS score. Technical summary The diff changes UserBean.java so that the password reset activation key is built from 32 bytes of java.security.SecureRandom output instead of a hash of System.currentTimeMillis(). It also replaces the 8-character new password, previously derived from the same timestamp hash, with 4 random bytes encoded as hex. The advisory does not state the vulnerability class, attack preconditions, affected versions, fixed version numbers, workarounds, or detection guidance, and it does not state whether exploitation has occurred. The text names no affected product versions beyond the Goobi viewer project itself. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef Impact if exploited ConfidentialityNone IntegrityLow AvailabilityLow How it is exploited Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Affects intranda Goobi intranda goobi-viewer-core Goobi viewer NIST National Vulnerability DatabasePublished Oct 23, 2026 15:17 UTC Read the advisory

Example	Finds
	Every word appears somewhere: title, summaries, IDs, vendor, or product
	An exact phrase
	One vendor. product: for a product, vp: for either
	Commas mean any of them, in every field
	Severity: critical, high, medium, low, or unknown
	CVSS score, with >, >=, <, or <=
	A score range
	Known exploited. is:kev works too, and kev:no leaves them out
	One source, by name
	Confidentiality impact: high, low, none, or any (low or high)
	Integrity and availability work the same way
	An advisory or CVE ID, or part of one
	A minus sign leaves out whatever the term matches

Vulnerability feed

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited

Affects

Executive summary

Technical summary

Impact if exploited

How it is exploited