Filter public vulnerability entries by severity / channel / vendor / time.
CVE-2026-111391 · 2026-10-16 · auto
SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can s…
CVE-2026-107648 · 2026-10-16 · auto
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_type, post_status, ids, loggedout, and POST post_title)' param…
CVE-2026-105959 · 2026-10-16 · auto
A flaw was found in spice-server. The GLZ encoder dictionary restore path truncates a size_t allocation size to int when calling the malloc callback, allowing a malicious authenticated SPICE client during VM live migrati…
CVE-2026-85475 · 2026-10-16 · auto
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DIS…
CVE-2026-76648 · 2026-10-16 · auto
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_acces…
CVE-2025-13947 · 2026-10-16 · auto
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK do…
CVE-2025-61662 · 2026-10-16 · auto
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can e…
CVE-2025-5987 · 2026-10-16 · auto
A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher…
CVE-2026-97812 · 2026-10-16 · auto
Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97811 · 2026-10-16 · auto
Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
CVE-2026-97810 · 2026-10-16 · auto
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-97809 · 2026-10-16 · auto
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97808 · 2026-10-16 · auto
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97807 · 2026-10-16 · auto
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97806 · 2026-10-16 · auto
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97803 · 2026-10-16 · auto
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-97800 · 2026-10-16 · auto
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
CVE-2026-97799 · 2026-10-16 · auto
Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
CVE-2026-97798 · 2026-10-16 · auto
Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-97794 · 2026-10-16 · auto
Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-97793 · 2026-10-16 · auto
Missing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
CVE-2026-97792 · 2026-10-16 · auto
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-97787 · 2026-10-16 · auto
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-96952 · 2026-10-16 · auto
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVE-2026-96945 · 2026-10-16 · auto
Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network.
CVE-2026-96937 · 2026-10-16 · auto
Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-96933 · 2026-10-16 · auto
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96932 · 2026-10-16 · auto
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96931 · 2026-10-16 · auto
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-88116 · 2026-10-16 · auto
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88114 · 2026-10-16 · auto
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-88112 · 2026-10-16 · auto
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-85903 · 2026-10-16 · auto
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-83889 · 2026-10-16 · auto
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
CVE-2026-83642 · 2026-10-16 · auto
Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2026-83635 · 2026-10-16 · auto
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
CVE-2026-70167 · 2026-10-16 · auto
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
CVE-2026-92766 · 2026-10-16 · auto
The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the use…
CVE-2026-14177 · 2026-10-16 · auto
Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13.
CVE-2026-111311 · 2026-10-16 · auto
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1…
CVE-2026-109224 · 2026-10-16 · auto
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in a…
CVE-2026-97640 · 2026-10-16 · auto
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM …
CVE-2026-97296 · 2026-10-16 · auto
Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.
CVE-2026-96339 · 2026-10-16 · auto
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
CVE-2026-92553 · 2026-10-16 · auto
The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient…
CVE-2026-92115 · 2026-10-16 · auto
The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to i…
CVE-2026-110701 · 2026-10-16 · auto
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization an…
CVE-2026-109193 · 2026-10-16 · auto
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute slug> (e.g. hp_custom_link)' parameter in all version…
CVE-2026-107768 · 2026-10-16 · auto
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insuf…
CVE-2026-104715 · 2026-10-16 · auto
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials…