CVE Watch - Daily CVE Digesthttps://dhairyapatel.tech/about/Daily digest of newly published CVEs and newly exploited vulnerabilities (NIST NVD + CISA KEV).enMon, 12 Oct 2026 21:41:55 +0000CVE Daily Digest 2026-10-11: 230 new CVEs (16 critical, 73 high)https://dhairyapatel.tech/about/?date=2026-10-11cve-watch-digest-2026-10-11Sun, 11 Oct 2026 23:59:59 +0000230 new CVEs published on 2026-10-11 (16 critical, 73 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-108576 - CRITICAL 10.0
    A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection...
  • CVE-2026-85118 - CRITICAL 9.8
    The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, allowing unauthenticated users to update and delete arbitrary WordPress options,...
  • CVE-2026-84737 - CRITICAL 9.8
    The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including ...
  • CVE-2026-84734 - CRITICAL 9.8
    The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtai...
  • CVE-2026-84254 - CRITICAL 9.8
    The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to t...
  • CVE-2026-84253 - CRITICAL 9.8
    The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to th...
  • CVE-2026-84252 - CRITICAL 9.8
    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the clic...
  • CVE-2026-84251 - CRITICAL 9.8
    The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the ...
  • CVE-2026-104028 - CRITICAL 9.8
    The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthe...
  • CVE-2026-108860 - CRITICAL 9.3
    BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key in WebStarter appsettings.json. Attackers can sign t...
  • CVE-2026-108753 - CRITICAL 9.3
    Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-compose.yml, which sets a fixed admin password and public JWT secret. Unauthenticated attackers can log in as admin or s...
  • CVE-2026-108707 - CRITICAL 9.3
    Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR a...
  • CVE-2026-86717 - CRITICAL 9.1
    The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to delete arbitrary WordPress options, which can take the site offline an...
  • CVE-2026-86706 - CRITICAL 9.1
    The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the caller choose which option is written, allowing unauthenticated users to alter arbit...
  • CVE-2026-85121 - CRITICAL 9.1
    The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated users to create and overwrite arbitrary WordPress options with request data, wh...
  • CVE-2026-81649 - CRITICAL 9.1
    The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthent...
  • CVE-2026-108963 - HIGH 8.8
    databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/in...
  • CVE-2026-108865 - HIGH 8.8
    AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 server never authenticates a resource owner. Attackers ca...
  • CVE-2026-108758 - HIGH 8.8
    Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attac...
  • CVE-2026-96227 - HIGH 8.8
    The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to stor...
  • CVE-2026-88905 - HIGH 8.8
    The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious Ja...
  • CVE-2026-88903 - HIGH 8.8
    The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arb...
  • CVE-2026-88827 - HIGH 8.8
    The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with...
  • CVE-2026-88826 - HIGH 8.8
    The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or escape that data before outputting it, allowing unauthentica...
  • CVE-2026-87764 - HIGH 8.8
    The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, al...
  • CVE-2026-87762 - HIGH 8.8
    The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret comparison it uses instead can be bypassed on installations where t...
  • CVE-2026-87760 - HIGH 8.8
    The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storing them and outputting them in a script context on an administ...
  • CVE-2026-86798 - HIGH 8.8
    The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing u...
  • CVE-2026-84261 - HIGH 8.8
    The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS ...
  • CVE-2026-84260 - HIGH 8.8
    The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS w...
  • CVE-2026-84259 - HIGH 8.8
    The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which c...
  • CVE-2026-84258 - HIGH 8.8
    The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS whi...
  • CVE-2026-103694 - HIGH 8.8
    The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, allowing any user with a self-registered account, such as a cu...
  • CVE-2026-103305 - HIGH 8.8
    The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Store...
  • CVE-2026-108905 - HIGH 8.7
    pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can ...
  • CVE-2026-108863 - HIGH 8.7
    Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attacke...
  • CVE-2026-108859 - HIGH 8.7
    mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitr...
  • CVE-2026-108746 - HIGH 8.7
    Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root ...
  • CVE-2026-108739 - HIGH 8.7
    OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via GET /v1/workspaces. Attackers can read the unmasked ...
  • CVE-2026-108714 - HIGH 8.7
    MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSocket installs Ktor WebSockets without a maxFrameSize ...

...and 49 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-10: 412 new CVEs (74 critical, 140 high)https://dhairyapatel.tech/about/?date=2026-10-10cve-watch-digest-2026-10-10Sat, 10 Oct 2026 23:59:59 +0000412 new CVEs published on 2026-10-10 (74 critical, 140 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-42696 - CRITICAL 10.0
    Unauthenticated Remote Code Execution (RCE) in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.19 versions.
  • CVE-2026-62129 - CRITICAL 9.9
    Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
  • CVE-2026-62024 - CRITICAL 9.9
    Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
  • CVE-2026-81797 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
  • CVE-2026-78535 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
  • CVE-2026-78533 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
  • CVE-2026-78531 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
  • CVE-2026-78529 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
  • CVE-2026-66569 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
  • CVE-2026-66568 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
  • CVE-2026-66567 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
  • CVE-2026-66565 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
  • CVE-2026-66564 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
  • CVE-2026-66563 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
  • CVE-2026-66483 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
  • CVE-2026-66482 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
  • CVE-2026-62125 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
  • CVE-2026-62124 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
  • CVE-2026-62123 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
  • CVE-2026-62120 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
  • CVE-2026-62090 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
  • CVE-2026-62087 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
  • CVE-2026-62086 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
  • CVE-2026-62077 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
  • CVE-2026-62076 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
  • CVE-2026-62054 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
  • CVE-2026-62053 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
  • CVE-2026-62052 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
  • CVE-2026-62051 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
  • CVE-2026-62050 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
  • CVE-2026-62032 - CRITICAL 9.8
    Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.
  • CVE-2026-62022 - CRITICAL 9.8
    Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.
  • CVE-2026-42723 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
  • CVE-2026-42719 - CRITICAL 9.8
    Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.
  • CVE-2026-42718 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
  • CVE-2026-42716 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
  • CVE-2026-39801 - CRITICAL 9.8
    Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
  • CVE-2026-106610 - CRITICAL 9.8
    Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
  • CVE-2026-105892 - CRITICAL 9.8
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia ...
  • CVE-2026-104398 - CRITICAL 9.8
    Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooComme...

...and 174 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-09: 315 new CVEs (35 critical, 132 high)https://dhairyapatel.tech/about/?date=2026-10-09cve-watch-digest-2026-10-09Fri, 09 Oct 2026 23:59:59 +0000315 new CVEs published on 2026-10-09 (35 critical, 132 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-94503 - CRITICAL 10.0
    Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.
  • CVE-2026-108263 - CRITICAL 9.9
    Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in co...
  • CVE-2026-86405 - CRITICAL 9.8
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects Prest...
  • CVE-2026-85531 - CRITICAL 9.8
    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCar...
  • CVE-2026-107806 - CRITICAL 9.4
    Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching m...
  • CVE-2026-108261 - CRITICAL 9.3
    Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into a...
  • CVE-2026-107845 - CRITICAL 9.3
    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listC...
  • CVE-2026-107824 - CRITICAL 9.3
    x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE with...
  • CVE-2026-39460 - CRITICAL 9.3
    Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be ex...
  • CVE-2026-33367 - CRITICAL 9.3
    SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authenti...
  • CVE-2026-28745 - CRITICAL 9.3
    Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the...
  • CVE-2026-15340 - CRITICAL 9.3
    lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
  • CVE-2026-108109 - CRITICAL 9.3
    PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Atta...
  • CVE-2026-108107 - CRITICAL 9.3
    PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted use...
  • CVE-2026-105278 - CRITICAL 9.3
    The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and...
  • CVE-2026-100730 - CRITICAL 9.3
    A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on system...
  • CVE-2026-96809 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booki...
  • CVE-2026-96331 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a throu...
  • CVE-2026-96330 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from...
  • CVE-2026-96328 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/...
  • CVE-2026-96327 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.
  • CVE-2026-93947 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
  • CVE-2026-107935 - CRITICAL 9.3
    A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket pa...
  • CVE-2026-107908 - CRITICAL 9.3
    A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code b...
  • CVE-2026-5759 - CRITICAL 9.3
    A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can...
  • CVE-2026-108157 - CRITICAL 9.2
    Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to take over accounts by abusing automatic OAuth email linking in OAuthService.sign...
  • CVE-2026-32645 - CRITICAL 9.2
    Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
  • CVE-2026-107910 - CRITICAL 9.2
    An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the ...
  • CVE-2026-7827 - CRITICAL 9.2
    A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replicati...
  • CVE-2026-108269 - CRITICAL 9.1
    Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certific...
  • CVE-2026-108268 - CRITICAL 9.1
    Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-...
  • CVE-2026-108267 - CRITICAL 9.1
    Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate publ...
  • CVE-2026-108266 - CRITICAL 9.1
    Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was b...
  • CVE-2026-108265 - CRITICAL 9.1
    Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Prior to wasm-v0.40.0, the SGX runtime's RA-TLS challenge certificate path placed the certificate public-key hash and clien...
  • CVE-2026-108264 - CRITICAL 9.1
    Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/...
  • CVE-2026-106155 - HIGH 8.9
    In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs i...
  • CVE-2026-55797 - HIGH 8.8
    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetch...
  • CVE-2026-107813 - HIGH 8.8
    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequir...
  • CVE-2026-107811 - HIGH 8.8
    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is ...
  • CVE-2026-107809 - HIGH 8.8
    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because manag...

...and 127 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-08: 497 new CVEs (53 critical, 201 high, 5 newly exploited)https://dhairyapatel.tech/about/?date=2026-10-08cve-watch-digest-2026-10-08Thu, 08 Oct 2026 23:59:59 +0000497 new CVEs published on 2026-10-08 (53 critical, 201 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 5

  • CVE-2015-5477 - ISC BIND: ISC BIND Data Processing Errors Vulnerability
  • CVE-2016-3081 - Apache Struts: Apache Struts Command Injection Vulnerability
  • CVE-2023-22894 - Strapi Strapi: Strapi Cleartext Storage of Sensitive Information Vulnerability
  • CVE-2021-3199 - ONLYOFFICE Docs: ONLYOFFICE Docs Server Path Traversal Vulnerability
  • CVE-2015-3306 - ProFTPD ProFTPD: ProFTPD Improper Access Control Vulnerability

Critical & High severity

  • CVE-2026-96207 - CRITICAL 10.0
    Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
  • CVE-2026-12260 - CRITICAL 10.0
    SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on...
  • CVE-2026-94510 - CRITICAL 9.9
    Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
  • CVE-2026-88131 - CRITICAL 9.8
    Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.
  • CVE-2026-77900 - CRITICAL 9.8
    Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
  • CVE-2026-56857 - CRITICAL 9.8
    On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This ...
  • CVE-2026-84249 - CRITICAL 9.8
    IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.
  • CVE-2026-80381 - CRITICAL 9.8
    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.
  • CVE-2026-75875 - CRITICAL 9.8
    IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.
  • CVE-2026-107722 - CRITICAL 9.8
    fast-jwt provides fast JSON Web Token (JWT) implementation. From 6.2.0 until 6.3.0, fast-jwt can misclassify RSA public-key text as an HMAC secret when the key has non-whitespace content before its PEM header. In src/cry...
  • CVE-2026-78406 - CRITICAL 9.8
    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untr...
  • CVE-2026-78401 - CRITICAL 9.8
    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untr...
  • CVE-2026-84272 - CRITICAL 9.8
    IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container i...
  • CVE-2026-82344 - CRITICAL 9.8
    IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments th...
  • CVE-2026-82335 - CRITICAL 9.8
    IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive ...
  • CVE-2026-93034 - CRITICAL 9.8
    SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payloads via pickle.loads() in _maybe_unwrap_pickle without type allowlisting or aut...
  • CVE-2026-14992 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.
  • CVE-2026-14502 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject em...
  • CVE-2026-14269 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. An una...
  • CVE-2026-15762 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.
  • CVE-2026-14991 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user coul...
  • CVE-2026-16340 - CRITICAL 9.8
    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in ...
  • CVE-2026-92555 - CRITICAL 9.8
    Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affect...
  • CVE-2026-85097 - CRITICAL 9.8
    The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 't...
  • CVE-2026-103692 - CRITICAL 9.8
    The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the requ...
  • CVE-2026-103646 - CRITICAL 9.8
    The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentication before a logged-out checkout is linked to, and logged in as, an existing WordPress account matching the submitted email address, and ...
  • CVE-2026-69435 - CRITICAL 9.6
    Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
  • CVE-2026-107406 - CRITICAL 9.5
    Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the followi...
  • CVE-2026-106126 - CRITICAL 9.4
    A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.
  • CVE-2026-103663 - CRITICAL 9.4
    Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence ...
  • CVE-2026-107726 - CRITICAL 9.3
    Hazelcast is a unified real-time data platform combining stream processing with a fast data store. Prior to 5.4.5, 5.5.10, and 5.6.1, improper validation of data supplied by a malicious client able to connect to a cluste...
  • CVE-2026-107780 - CRITICAL 9.3
    Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers c...
  • CVE-2026-107779 - CRITICAL 9.3
    Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false). ...
  • CVE-2026-104076 - CRITICAL 9.3
    TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify de...
  • CVE-2026-104075 - CRITICAL 9.3
    TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attacke...
  • CVE-2026-107704 - CRITICAL 9.3
    The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the ident...
  • CVE-2026-107703 - CRITICAL 9.3
    @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell...
  • CVE-2026-107700 - CRITICAL 9.3
    dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js...
  • CVE-2026-107699 - CRITICAL 9.3
    ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metachar...
  • CVE-2026-9209 - CRITICAL 9.3
    mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-suppl...

...and 214 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-07: 340 new CVEs (51 critical, 122 high)https://dhairyapatel.tech/about/?date=2026-10-07cve-watch-digest-2026-10-07Wed, 07 Oct 2026 23:59:59 +0000340 new CVEs published on 2026-10-07 (51 critical, 122 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-76482 - CRITICAL 10.0
    As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive ...
  • CVE-2025-70518 - CRITICAL 10.0
    The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject co...
  • CVE-2026-102255 - CRITICAL 10.0
    A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit t...
  • CVE-2026-76284 - CRITICAL 9.8
    Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk Enterprise versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15. The vulnerabilities are grouped by Common Weakness Enumeration (...
  • CVE-2026-76268 - CRITICAL 9.8
    In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster me...
  • CVE-2026-95606 - CRITICAL 9.8
    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
  • CVE-2026-76501 - CRITICAL 9.8
    A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitra...
  • CVE-2026-76500 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This...
  • CVE-2026-76499 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This...
  • CVE-2026-76498 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This...
  • CVE-2026-76486 - CRITICAL 9.8
    A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privilege...
  • CVE-2026-76485 - CRITICAL 9.8
    A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privilege...
  • CVE-2026-76480 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive ...
  • CVE-2026-76471 - CRITICAL 9.8
    A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected dev...
  • CVE-2026-76465 - CRITICAL 9.8
    A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remot...
  • CVE-2026-76459 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening relea...
  • CVE-2026-76455 - CRITICAL 9.8
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening relea...
  • CVE-2026-62253 - CRITICAL 9.8
    Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions (`JWTMiddleware` and `JWTMiddlewareV4`) immediately return `next(c)` when `jwtSecret == ""`. The JWT secret de...
  • CVE-2026-62252 - CRITICAL 9.8
    Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an `admin` account with the passw...
  • CVE-2025-70521 - CRITICAL 9.8
    The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject co...
  • CVE-2026-105192 - CRITICAL 9.8
    LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed ...
  • CVE-2026-93675 - CRITICAL 9.8
    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
  • CVE-2026-93674 - CRITICAL 9.8
    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
  • CVE-2026-104334 - CRITICAL 9.8
    IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
  • CVE-2026-76464 - CRITICAL 9.6
    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening ...
  • CVE-2026-107282 - CRITICAL 9.4
    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but...
  • CVE-2025-64393 - CRITICAL 9.4
    This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
  • CVE-2026-95605 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a th...
  • CVE-2026-92414 - CRITICAL 9.3
    : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token...
  • CVE-2026-107204 - CRITICAL 9.3
    LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtin...
  • CVE-2026-96408 - CRITICAL 9.3
    A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl script or an SQL query on the affected product.
  • CVE-2026-107104 - CRITICAL 9.3
    This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially ...
  • CVE-2026-107103 - CRITICAL 9.3
    This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying ...
  • CVE-2026-107102 - CRITICAL 9.3
    This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerab...
  • CVE-2026-103416 - CRITICAL 9.3
    Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control...
  • CVE-2026-102782 - CRITICAL 9.3
    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind....
  • CVE-2026-59346 - CRITICAL 9.3
    VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute ...
  • CVE-2026-19572 - CRITICAL 9.3
    A security vulnerability has been identified in FlexNet Publisher lmadmin. The vulnerability exists in a SOAP handler, where a hardcoded authentication bypass could allow an unauthenticated user to obtain a privileged ad...
  • CVE-2026-14911 - CRITICAL 9.3
    Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service conditio...
  • CVE-2026-19386 - CRITICAL 9.3
    A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configuration file upload that exceeds the expected buffer size.Refer to the ' Security...

...and 133 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-06: 1016 new CVEs (102 critical, 372 high)https://dhairyapatel.tech/about/?date=2026-10-06cve-watch-digest-2026-10-06Tue, 06 Oct 2026 23:59:59 +00001016 new CVEs published on 2026-10-06 (102 critical, 372 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-106218 - CRITICAL 10.0
    In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
  • CVE-2026-106102 - CRITICAL 10.0
    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied throug...
  • CVE-2026-105857 - CRITICAL 10.0
    Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that exe...
  • CVE-2026-63692 - CRITICAL 10.0
    Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerabili...
  • CVE-2026-63688 - CRITICAL 10.0
    Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker coul...
  • CVE-2026-39773 - CRITICAL 10.0
    Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.
  • CVE-2026-39770 - CRITICAL 10.0
    Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.
  • CVE-2026-32579 - CRITICAL 10.0
    Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
  • CVE-2026-105484 - CRITICAL 10.0
    A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such ...
  • CVE-2026-79798 - CRITICAL 9.9
    SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Man...
  • CVE-2026-67269 - CRITICAL 9.9
    Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker c...
  • CVE-2026-39759 - CRITICAL 9.9
    Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.
  • CVE-2026-39757 - CRITICAL 9.9
    Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.
  • CVE-2026-39755 - CRITICAL 9.9
    Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions.
  • CVE-2026-32568 - CRITICAL 9.9
    Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
  • CVE-2026-94205 - CRITICAL 9.8
    Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary t...
  • CVE-2026-79805 - CRITICAL 9.8
    An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
  • CVE-2026-79801 - CRITICAL 9.8
    A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation c...
  • CVE-2026-79796 - CRITICAL 9.8
    Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploi...
  • CVE-2026-76754 - CRITICAL 9.8
    A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation ...
  • CVE-2026-76753 - CRITICAL 9.8
    A format string vulnerability in an affected service interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to corrupt process memory. Successful exploitation could allow an a...
  • CVE-2026-76752 - CRITICAL 9.8
    Authentication bypass vulnerabilities exist in the web-based management and API interfaces of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to circumvent ...
  • CVE-2026-76751 - CRITICAL 9.8
    A missing integrity verification vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary code on the affected en...
  • CVE-2026-76750 - CRITICAL 9.8
    Deserialization of untrusted data vulnerabilities exist in the web interface of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on...
  • CVE-2026-76744 - CRITICAL 9.8
    Buffer overflow vulnerabilities exist in the affected interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code.
  • CVE-2026-76743 - CRITICAL 9.8
    A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of...
  • CVE-2026-76742 - CRITICAL 9.8
    Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.
  • CVE-2026-73278 - CRITICAL 9.8
    Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow c...
  • CVE-2026-106446 - CRITICAL 9.8
    Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.compile() and Handlebars.precompile() accept pre-parsed AST objects while validating only selected PathEx...
  • CVE-2026-55330 - CRITICAL 9.8
    In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User i...
  • CVE-2026-106511 - CRITICAL 9.8
    MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allo...
  • CVE-2026-105859 - CRITICAL 9.8
    Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies col...
  • CVE-2025-71383 - CRITICAL 9.8
    Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field. This occurs because of an error in a JSON parser...
  • CVE-2026-105845 - CRITICAL 9.8
    Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic ...
  • CVE-2026-61421 - CRITICAL 9.8
    Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this ...
  • CVE-2026-106016 - CRITICAL 9.8
    Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1.
  • CVE-2026-98365 - CRITICAL 9.8
    In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access mr_check_range() validates that [iova, iova+length) falls within the register...
  • CVE-2026-98323 - CRITICAL 9.8
    In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callb...
  • CVE-2026-39797 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versions.
  • CVE-2026-39761 - CRITICAL 9.8
    Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.

...and 434 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-05: 406 new CVEs (31 critical, 118 high)https://dhairyapatel.tech/about/?date=2026-10-05cve-watch-digest-2026-10-05Mon, 05 Oct 2026 23:59:59 +0000406 new CVEs published on 2026-10-05 (31 critical, 118 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-100103 - CRITICAL 10.0
    Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application priv...
  • CVE-2026-105740 - CRITICAL 9.9
    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio...
  • CVE-2026-105697 - CRITICAL 9.9
    Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist...
  • CVE-2026-105691 - CRITICAL 9.9
    Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through...
  • CVE-2026-105636 - CRITICAL 9.9
    Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targ...
  • CVE-2026-97283 - CRITICAL 9.8
    Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.
  • CVE-2026-88424 - CRITICAL 9.8
    FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via cr...
  • CVE-2026-105641 - CRITICAL 9.8
    Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults that r...
  • CVE-2026-105639 - CRITICAL 9.8
    Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authe...
  • CVE-2026-104711 - CRITICAL 9.8
    Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action map...
  • CVE-2026-88395 - CRITICAL 9.8
    GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
  • CVE-2026-88393 - CRITICAL 9.8
    WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array() function in app/Module/Base....
  • CVE-2026-37719 - CRITICAL 9.8
    An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
  • CVE-2026-88391 - CRITICAL 9.8
    Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/**, so /h2-console is exposed with no authentication and the embedded H2 DB use...
  • CVE-2026-105637 - CRITICAL 9.6
    Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constra...
  • CVE-2026-103510 - CRITICAL 9.5
    P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege,...
  • CVE-2026-100102 - CRITICAL 9.5
    Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potenti...
  • CVE-2026-91107 - CRITICAL 9.3
    openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password...
  • CVE-2026-21589 - CRITICAL 9.3
    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye. This Arbitrary File A...
  • CVE-2026-103352 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affe...
  • CVE-2026-102428 - CRITICAL 9.3
    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.
  • CVE-2026-105285 - CRITICAL 9.3
    A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQ...
  • CVE-2026-105284 - CRITICAL 9.3
    A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to im...
  • CVE-2026-77226 - CRITICAL 9.2
    Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only dire...
  • CVE-2026-105293 - CRITICAL 9.2
    Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the D...
  • CVE-2026-105640 - CRITICAL 9.1
    Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying t...
  • CVE-2026-105638 - CRITICAL 9.1
    Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and...
  • CVE-2017-20285 - CRITICAL 9.1
    YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and...
  • CVE-2026-105294 - CRITICAL 9.1
    Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord...
  • CVE-2026-105223 - CRITICAL 9.1
    maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On...
  • CVE-2026-79820 - CRITICAL 9.0
    A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
  • CVE-2026-105744 - HIGH 8.8
    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") ...
  • CVE-2026-97257 - HIGH 8.8
    Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.
  • CVE-2026-100511 - HIGH 8.8
    Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.
  • CVE-2026-58835 - HIGH 8.8
    In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not need...
  • CVE-2026-55280 - HIGH 8.8
    In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed f...
  • CVE-2026-45524 - HIGH 8.8
    In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...
  • CVE-2026-105642 - HIGH 8.8
    Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a...
  • CVE-2026-104714 - HIGH 8.8
    Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that messa...
  • CVE-2026-101919 - HIGH 8.8
    A flaw was found in the HyperShift operator. The operator copies user-provided Kubernetes configuration (kubeconfig) secrets directly into the privileged control plane namespace without proper validation or sanitization....

...and 109 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-04: 68 new CVEs (13 critical, 16 high, 1 newly exploited)https://dhairyapatel.tech/about/?date=2026-10-04cve-watch-digest-2026-10-04Sun, 04 Oct 2026 23:59:59 +000068 new CVEs published on 2026-10-04 (13 critical, 16 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 1

  • CVE-2026-88779 - Citrix NetScaler: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Critical & High severity

  • CVE-2026-105089 - CRITICAL 9.3
    WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouP...
  • CVE-2026-105086 - CRITICAL 9.3
    WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips t...
  • CVE-2026-105215 - CRITICAL 9.3
    ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields witho...
  • CVE-2026-105209 - CRITICAL 9.3
    ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not ...
  • CVE-2026-105207 - CRITICAL 9.3
    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 ...
  • CVE-2026-103355 - CRITICAL 9.3
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor...
  • CVE-2026-105135 - CRITICAL 9.3
    A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inpu...
  • CVE-2026-105134 - CRITICAL 9.3
    A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument r...
  • CVE-2026-105211 - CRITICAL 9.2
    ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a l...
  • CVE-2026-105222 - CRITICAL 9.1
    The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path at...
  • CVE-2026-105221 - CRITICAL 9.1
    The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can pres...
  • CVE-2026-105218 - CRITICAL 9.1
    gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to re...
  • CVE-2026-105216 - CRITICAL 9.1
    go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-m...
  • CVE-2026-105213 - HIGH 8.8
    ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an ex...
  • CVE-2026-105210 - HIGH 8.8
    ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any prim...
  • CVE-2026-93549 - HIGH 8.8
    The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress core's REST nonce protection for every route, allowing an attacker to perform a c...
  • CVE-2026-105219 - HIGH 8.7
    Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a craf...
  • CVE-2026-105212 - HIGH 8.7
    ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any...
  • CVE-2026-105208 - HIGH 8.7
    ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's ext...
  • CVE-2026-88779 - HIGH 8.7 [EXPLOITED]
    Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
  • CVE-2026-105123 - HIGH 8.7
    W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Att...
  • CVE-2026-105126 - HIGH 8.6
    LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Superadmin by editing or renaming roles. Attackers with role.edit can rename their r...
  • CVE-2026-105220 - HIGH 8.5
    Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the...
  • CVE-2026-97307 - HIGH 7.5
    Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n...
  • CVE-2026-97276 - HIGH 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP Statistics wp-statistics allows Reflected XSS.This issue affects WP Statistics: from n/a through 14.16.1...
  • CVE-2026-103354 - HIGH 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenber...
  • CVE-2026-103344 - HIGH 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor...
  • CVE-2026-103062 - HIGH 7.1
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a th...
  • CVE-2026-105129 - HIGH 7.1
    LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /ap...

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-03: 115 new CVEs (5 critical, 45 high)https://dhairyapatel.tech/about/?date=2026-10-03cve-watch-digest-2026-10-03Sat, 03 Oct 2026 23:59:59 +0000115 new CVEs published on 2026-10-03 (5 critical, 45 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-105105 - CRITICAL 9.8
    CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to...
  • CVE-2026-105080 - CRITICAL 9.4
    In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.
  • CVE-2026-71885 - CRITICAL 9.2
    In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the ...
  • CVE-2026-92084 - CRITICAL 9.1
    The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing...
  • CVE-2026-87115 - CRITICAL 9.1
    The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. T...
  • CVE-2026-96451 - HIGH 8.8
    Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
  • CVE-2026-105115 - HIGH 8.8
    OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SO...
  • CVE-2026-18443 - HIGH 8.8
    The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due...
  • CVE-2026-88783 - HIGH 8.8
    The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated user...
  • CVE-2026-97644 - HIGH 8.8
    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists bec...
  • CVE-2026-92536 - HIGH 8.8
    The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in...
  • CVE-2026-71890 - HIGH 8.7
    In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external commit's proposal list, org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals, counted the proposals by type and bounded the r...
  • CVE-2026-71889 - HIGH 8.7
    In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints t...
  • CVE-2026-71888 - HIGH 8.7
    In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a message whose digestAlgorithm and authAttrs fields disagreed about whether authenticated attributes were present. RFC 5652 sec....
  • CVE-2026-104433 - HIGH 8.7
    Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length hands...
  • CVE-2026-89236 - HIGH 8.6
    The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries...
  • CVE-2026-103065 - HIGH 8.2
    Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.
  • CVE-2026-85515 - HIGH 8.2
    In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1 path with no integrity check performed at all. RFC 9580 sec. 13.7 permits an im...
  • CVE-2026-71887 - HIGH 8.2
    In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried no embedded Primary Key Binding (cross-certification) signature,...
  • CVE-2026-71886 - HIGH 8.2
    In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the issuing certificate, without requiring that component t...
  • CVE-2026-71883 - HIGH 8.2
    In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteAr...
  • CVE-2026-91078 - HIGH 8.2
    The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login end...
  • CVE-2026-104476 - HIGH 8.2
    Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compre...
  • CVE-2026-94505 - HIGH 8.1
    The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying t...
  • CVE-2026-101923 - HIGH 8.1
    The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_im...
  • CVE-2026-105119 - HIGH 7.6
    OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to authorization requests whose response_type is exactly code, so codes issued through OpenID Connect hybrid flows (code token, code id_token, code t...
  • CVE-2026-96267 - HIGH 7.5
    The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user sup...
  • CVE-2026-75028 - HIGH 7.5
    The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This ma...
  • CVE-2026-97337 - HIGH 7.5
    The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation en...
  • CVE-2026-103913 - HIGH 7.5
    The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the abse...
  • CVE-2026-103514 - HIGH 7.5
    The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity w...
  • CVE-2026-101161 - HIGH 7.5
    The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in...
  • CVE-2026-101160 - HIGH 7.5
    The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated...
  • CVE-2026-101159 - HIGH 7.5
    The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored...
  • CVE-2026-93428 - HIGH 7.5
    The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 T...
  • CVE-2026-97660 - HIGH 7.2
    The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient inp...
  • CVE-2026-93889 - HIGH 7.2
    The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input san...
  • CVE-2026-97341 - HIGH 7.2
    The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input saniti...
  • CVE-2026-96650 - HIGH 7.2
    The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and out...
  • CVE-2026-96575 - HIGH 7.2
    The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in all versions up to, and ...

...and 10 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-02: 393 new CVEs (41 critical, 188 high, 2 newly exploited)https://dhairyapatel.tech/about/?date=2026-10-02cve-watch-digest-2026-10-02Fri, 02 Oct 2026 23:59:59 +0000393 new CVEs published on 2026-10-02 (41 critical, 188 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 2

  • CVE-2026-102490 - Zammad GmbH Zammad: Zammad GmbH Zammad Improper Privilege Management Vulnerability
  • CVE-2026-102489 - Zammad GmbH Zammad: Zammad GmbH Zammad Session Fixation Vulnerability

Critical & High severity

  • CVE-2026-103956 - CRITICAL 10.0
    Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool se...
  • CVE-2026-90970 - CRITICAL 9.9
    GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, coul...
  • CVE-2026-93698 - CRITICAL 9.9
    Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
  • CVE-2026-51922 - CRITICAL 9.8
    agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
  • CVE-2026-51918 - CRITICAL 9.8
    FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
  • CVE-2026-51915 - CRITICAL 9.8
    TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_i...
  • CVE-2026-51911 - CRITICAL 9.8
    vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution.
  • CVE-2026-51904 - CRITICAL 9.8
    SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_executio...
  • CVE-2026-51898 - CRITICAL 9.8
    sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
  • CVE-2026-104846 - CRITICAL 9.8
    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produ...
  • CVE-2026-19652 - CRITICAL 9.8
    The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iteratin...
  • CVE-2026-94541 - CRITICAL 9.8
    The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is author...
  • CVE-2026-103877 - CRITICAL 9.8
    Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's loadSchema() subschema search with a schema object that contains a ...
  • CVE-2026-97637 - CRITICAL 9.8
    The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-...
  • CVE-2026-19660 - CRITICAL 9.8
    The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `...
  • CVE-2026-14378 - CRITICAL 9.8
    The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the att...
  • CVE-2026-103630 - CRITICAL 9.6
    Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-103628 - CRITICAL 9.6
    Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
  • CVE-2026-103626 - CRITICAL 9.6
    Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted ...
  • CVE-2026-104849 - CRITICAL 9.5
    Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted O...
  • CVE-2026-104848 - CRITICAL 9.5
    Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowin...
  • CVE-2026-75937 - CRITICAL 9.4
    A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web ser...
  • CVE-2026-86325 - CRITICAL 9.4
    A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account...
  • CVE-2026-104480 - CRITICAL 9.4
    Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path (the voice gateway, or an equiva...
  • CVE-2026-84411 - CRITICAL 9.3
    The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attack...
  • CVE-2026-95102 - CRITICAL 9.3
    WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform un...
  • CVE-2026-82042 - CRITICAL 9.3
    UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environm...
  • CVE-2026-104019 - CRITICAL 9.3
    OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5,...
  • CVE-2023-54405 - CRITICAL 9.3
    H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to...
  • CVE-2026-104610 - CRITICAL 9.3
    A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the arg...
  • CVE-2026-103764 - CRITICAL 9.3
    Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data po...
  • CVE-2026-83632 - CRITICAL 9.2
    Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommende...
  • CVE-2026-104467 - CRITICAL 9.2
    YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send re...
  • CVE-2026-91135 - CRITICAL 9.2
    Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into th...
  • CVE-2026-51906 - CRITICAL 9.1
    In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulatin...
  • CVE-2026-103648 - CRITICAL 9.1
    Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
  • CVE-2026-63569 - CRITICAL 9.1
    Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed...
  • CVE-2026-15896 - CRITICAL 9.1
    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticate...
  • CVE-2026-93697 - CRITICAL 9.0
    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
  • CVE-2026-93029 - CRITICAL 9.0
    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

...and 189 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-10-01: 392 new CVEs (51 critical, 168 high, 1 newly exploited)https://dhairyapatel.tech/about/?date=2026-10-01cve-watch-digest-2026-10-01Thu, 01 Oct 2026 23:59:59 +0000392 new CVEs published on 2026-10-01 (51 critical, 168 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 1

  • CVE-2026-104286 - Fortinet FortiMail: Fortinet FortiMail Path Traversal Vulnerability

Critical & High severity

  • CVE-2026-55393 - CRITICAL 10.0
    Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyn...
  • CVE-2026-101148 - CRITICAL 10.0
    The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download ...
  • CVE-2026-96658 - CRITICAL 9.9
    A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delega...
  • CVE-2026-79901 - CRITICAL 9.9
    In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An att...
  • CVE-2026-51897 - CRITICAL 9.8
    RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can trigger attacker-controlled code or command execution
  • CVE-2026-51893 - CRITICAL 9.8
    infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visi...
  • CVE-2026-51886 - CRITICAL 9.8
    langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-...
  • CVE-2026-51884 - CRITICAL 9.8
    The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on ...
  • CVE-2026-51881 - CRITICAL 9.8
    deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment.
  • CVE-2026-51880 - CRITICAL 9.8
    deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot w...
  • CVE-2026-104286 - CRITICAL 9.8 [EXPLOITED]
    An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 thr...
  • CVE-2026-104056 - CRITICAL 9.8
    Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with ...
  • CVE-2026-59797 - CRITICAL 9.8
    Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-57941 - CRITICAL 9.8
    Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-56154 - CRITICAL 9.8
    Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
  • CVE-2026-12627 - CRITICAL 9.8
    Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memo...
  • CVE-2026-103752 - CRITICAL 9.8
    Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
  • CVE-2026-75957 - CRITICAL 9.8
    The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_c...
  • CVE-2026-15989 - CRITICAL 9.8
    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg()...
  • CVE-2026-56662 - CRITICAL 9.6
    GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed n...
  • CVE-2026-18397 - CRITICAL 9.4
    This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. Th...
  • CVE-2026-55395 - CRITICAL 9.4
    Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and First...
  • CVE-2026-14984 - CRITICAL 9.4
    Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackB...
  • CVE-2026-94620 - CRITICAL 9.4
    Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's assignment repository and then writes autograd...
  • CVE-2026-14157 - CRITICAL 9.4
    Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via a crafted file uploaded through the web management interface.
  • CVE-2026-71449 - CRITICAL 9.3
    : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63.
  • CVE-2026-103922 - CRITICAL 9.3
    Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its...
  • CVE-2026-13043 - CRITICAL 9.3
    A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and ...
  • CVE-2026-62071 - CRITICAL 9.3
    Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.
  • CVE-2026-103264 - CRITICAL 9.3
    Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers wh...
  • CVE-2026-103244 - CRITICAL 9.3
    ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can i...
  • CVE-2026-103655 - CRITICAL 9.3
    MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted more than once within its time-based validity window. The issue exists in the ...
  • CVE-2025-41753 - CRITICAL 9.3
    The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacke...
  • CVE-2026-82829 - CRITICAL 9.3
    Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This is...
  • CVE-2026-82827 - CRITICAL 9.3
    Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit admini...
  • CVE-2026-82825 - CRITICAL 9.3
    Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This allows an unauthenticated attacker to invoke a critical API, potentially leading to unauthorized retrie...
  • CVE-2026-82824 - CRITICAL 9.3
    Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: throu...
  • CVE-2026-76142 - CRITICAL 9.3
    Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthenticated attacker to invoke internal functions
  • CVE-2026-102628 - CRITICAL 9.2
    The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger...
  • CVE-2026-51883 - CRITICAL 9.1
    The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences (such as `..\`) into the `knowledge_base_name`...

...and 179 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-09-30: 655 new CVEs (73 critical, 310 high, 1 newly exploited)https://dhairyapatel.tech/about/?date=2026-09-30cve-watch-digest-2026-09-30Wed, 30 Sep 2026 23:59:59 +0000655 new CVEs published on 2026-09-30 (73 critical, 310 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 1

  • CVE-2026-76504 - Cisco Catalyst SD-WAN Manager: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Critical & High severity

  • CVE-2026-55107 - CRITICAL 10.0
    Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-generated code, user formulas, student submissions, third-party plugins) in-proces...
  • CVE-2026-102427 - CRITICAL 10.0
    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no aut...
  • CVE-2026-76570 - CRITICAL 10.0
    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any tas...
  • CVE-2026-96349 - CRITICAL 10.0
    Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.
  • CVE-2026-51872 - CRITICAL 9.8
    Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.
  • CVE-2026-51871 - CRITICAL 9.8
    Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct execution of LLM-generated c...
  • CVE-2026-51870 - CRITICAL 9.8
    DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.
  • CVE-2026-51869 - CRITICAL 9.8
    DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.
  • CVE-2026-51867 - CRITICAL 9.8
    agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access opera...
  • CVE-2026-51866 - CRITICAL 9.8
    In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.
  • CVE-2026-51861 - CRITICAL 9.8
    bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.
  • CVE-2026-51858 - CRITICAL 9.8
    In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.
  • CVE-2026-51857 - CRITICAL 9.8
    In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.
  • CVE-2026-51856 - CRITICAL 9.8
    In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service ...
  • CVE-2026-102115 - CRITICAL 9.8
    Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that...
  • CVE-2026-100512 - CRITICAL 9.8
    Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
  • CVE-2026-55494 - CRITICAL 9.8
    Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent ...
  • CVE-2026-100277 - CRITICAL 9.8
    In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature
  • CVE-2026-100273 - CRITICAL 9.8
    In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
  • CVE-2026-100255 - CRITICAL 9.8
    In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
  • CVE-2026-18782 - CRITICAL 9.8
    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issu...
  • CVE-2026-82307 - CRITICAL 9.8
    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
  • CVE-2026-97274 - CRITICAL 9.8
    Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
  • CVE-2026-97248 - CRITICAL 9.8
    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
  • CVE-2026-96350 - CRITICAL 9.8
    Subscriber Privilege Escalation in Estatik <= 4.3.5 versions.
  • CVE-2026-76504 - CRITICAL 9.8 [EXPLOITED]
    A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This ...
  • CVE-2026-88920 - CRITICAL 9.8
    An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attac...
  • CVE-2026-75873 - CRITICAL 9.8
    The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, includi...
  • CVE-2026-103110 - CRITICAL 9.8
    Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.
  • CVE-2026-102149 - CRITICAL 9.4
    Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confid...
  • CVE-2026-55181 - CRITICAL 9.4
    Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint co...
  • CVE-2026-102490 - CRITICAL 9.4 [EXPLOITED]
    Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the ...
  • CVE-2026-102489 - CRITICAL 9.4 [EXPLOITED]
    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to c...
  • CVE-2026-93903 - CRITICAL 9.4
    LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
  • CVE-2026-103109 - CRITICAL 9.4
    Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a den...
  • CVE-2026-103056 - CRITICAL 9.4
    AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_r...
  • CVE-2026-102147 - CRITICAL 9.3
    A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator wh...
  • CVE-2026-103475 - CRITICAL 9.3
    yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endp...
  • CVE-2026-103470 - CRITICAL 9.3
    In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
  • CVE-2026-103395 - CRITICAL 9.3
    LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the vis...

...and 343 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-09-29: 605 new CVEs (90 critical, 249 high, 1 newly exploited)https://dhairyapatel.tech/about/?date=2026-09-29cve-watch-digest-2026-09-29Tue, 29 Sep 2026 23:59:59 +0000605 new CVEs published on 2026-09-29 (90 critical, 249 high). View all on CVE Watch

Added to CISA KEV (actively exploited): 1

  • CVE-2026-86950 - Apple Multiple Products: Apple Multiple Products Out-of-Bounds Write Vulnerability

Critical & High severity

  • CVE-2026-71379 - CRITICAL 10.0
    The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
  • CVE-2026-96587 - CRITICAL 10.0
    The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, o...
  • CVE-2026-84154 - CRITICAL 9.9
    A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
  • CVE-2026-103044 - CRITICAL 9.8
    XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, ...
  • CVE-2026-94952 - CRITICAL 9.8
    A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuratio...
  • CVE-2026-79538 - CRITICAL 9.8
    metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).
  • CVE-2026-76722 - CRITICAL 9.8
    Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful...
  • CVE-2026-76721 - CRITICAL 9.8
    Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could ...
  • CVE-2026-39117 - CRITICAL 9.8
    An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php
  • CVE-2024-31026 - CRITICAL 9.8
    An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module.
  • CVE-2026-102827 - CRITICAL 9.8
    simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option...
  • CVE-2026-77177 - CRITICAL 9.8
    Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side ex...
  • CVE-2026-100810 - CRITICAL 9.8
    Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
  • CVE-2026-100788 - CRITICAL 9.8
    Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
  • CVE-2026-91048 - CRITICAL 9.8
    The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (...
  • CVE-2026-91012 - CRITICAL 9.8
    org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input wit...
  • CVE-2026-76725 - CRITICAL 9.6
    A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation ...
  • CVE-2026-76724 - CRITICAL 9.6
    A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Succe...
  • CVE-2026-76723 - CRITICAL 9.6
    Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow...
  • CVE-2026-102331 - CRITICAL 9.6
    Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Cri...
  • CVE-2026-102316 - CRITICAL 9.6
    Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: ...
  • CVE-2026-102309 - CRITICAL 9.6
    Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-102308 - CRITICAL 9.6
    Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: ...
  • CVE-2026-102306 - CRITICAL 9.6
    Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-102304 - CRITICAL 9.6
    Use after free in Passwords in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-95357 - CRITICAL 9.6
    Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: C...
  • CVE-2026-95356 - CRITICAL 9.6
    Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium ...
  • CVE-2026-95350 - CRITICAL 9.6
    Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
  • CVE-2026-95349 - CRITICAL 9.6
    Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Cri...
  • CVE-2026-95347 - CRITICAL 9.6
    Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
  • CVE-2026-95339 - CRITICAL 9.6
    Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
  • CVE-2026-95331 - CRITICAL 9.6
    Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2026-95329 - CRITICAL 9.6
    Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity:...
  • CVE-2026-95325 - CRITICAL 9.6
    Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
  • CVE-2026-95318 - CRITICAL 9.6
    Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-95313 - CRITICAL 9.6
    Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
  • CVE-2026-95311 - CRITICAL 9.6
    Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...
  • CVE-2026-95310 - CRITICAL 9.6
    Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
  • CVE-2026-95299 - CRITICAL 9.6
    Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
  • CVE-2026-95284 - CRITICAL 9.6
    Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

...and 299 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>CVE Daily Digest 2026-09-28: 303 new CVEs (32 critical, 106 high)https://dhairyapatel.tech/about/?date=2026-09-28cve-watch-digest-2026-09-28Mon, 28 Sep 2026 23:59:59 +0000303 new CVEs published on 2026-09-28 (32 critical, 106 high). View all on CVE Watch

Critical & High severity

  • CVE-2026-87799 - CRITICAL 9.9
    Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or custom storag...
  • CVE-2026-85526 - CRITICAL 9.9
    Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesyst...
  • CVE-2026-82377 - CRITICAL 9.9
    Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers ...
  • CVE-2026-96760 - CRITICAL 9.8
    Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified w...
  • CVE-2026-90924 - CRITICAL 9.8
    Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6....
  • CVE-2026-82384 - CRITICAL 9.8
    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that a...
  • CVE-2026-88804 - CRITICAL 9.6
    An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.1...
  • CVE-2026-12342 - CRITICAL 9.6
    This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.
  • CVE-2026-85185 - CRITICAL 9.6
    Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to ...
  • CVE-2026-81867 - CRITICAL 9.4
    A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permission...
  • CVE-2026-19759 - CRITICAL 9.4
    An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitr...
  • CVE-2026-101110 - CRITICAL 9.3
    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function...
  • CVE-2026-101108 - CRITICAL 9.3
    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable ...
  • CVE-2026-100752 - CRITICAL 9.3
    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category ...
  • CVE-2026-86102 - CRITICAL 9.3
    An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.
  • CVE-2026-101891 - CRITICAL 9.3
    An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.
  • CVE-2026-101077 - CRITICAL 9.3
    A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out r...
  • CVE-2026-101076 - CRITICAL 9.3
    A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /set_ntp_server_ip.cgi of the component CGI Handler. The manipulation of the argument ntp_ip results in os command i...
  • CVE-2026-101075 - CRITICAL 9.3
    A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /location_time.cgi of the component Location Time Handler. The manipulation of the argument...
  • CVE-2026-73640 - CRITICAL 9.3
    Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. ...
  • CVE-2026-101072 - CRITICAL 9.3
    A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection....
  • CVE-2026-101039 - CRITICAL 9.3
    A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The at...
  • CVE-2026-101001 - CRITICAL 9.3
    A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUE...
  • CVE-2026-101000 - CRITICAL 9.3
    A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argu...
  • CVE-2026-73642 - CRITICAL 9.2
    Dayforce Payroll is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because...
  • CVE-2026-102334 - CRITICAL 9.1
    Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials v...
  • CVE-2026-102268 - CRITICAL 9.1
    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography load...
  • CVE-2026-102267 - CRITICAL 9.1
    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configure...
  • CVE-2026-102266 - CRITICAL 9.1
    PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. Thi...
  • CVE-2026-49994 - CRITICAL 9.1
    Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-devic...
  • CVE-2026-101894 - CRITICAL 9.1
    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted syml...
  • CVE-2026-82378 - CRITICAL 9.0
    Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer to bind that t...
  • CVE-2026-101074 - HIGH 8.9
    A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function password-check of the file /bin/boa of the component Authentication. Executing a manipulation of the argument Username can...
  • CVE-2026-87741 - HIGH 8.8
    The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability e...
  • CVE-2026-86950 - HIGH 8.8 [EXPLOITED]
    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to a...
  • CVE-2026-88808 - HIGH 8.8
    A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It a...
  • CVE-2026-90926 - HIGH 8.8
    Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6....
  • CVE-2026-86595 - HIGH 8.8
    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.
  • CVE-2026-12265 - HIGH 8.8
    Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
  • CVE-2026-78424 - HIGH 8.8
    Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to i...

...and 98 more on the website.

Data: NIST NVD & CISA KEV. Sent by CVE Watch - https://dhairyapatel.tech/about/

]]>