| CVE-2026-96460 | MEDIUM | 5.4 | A flaw was found in the token exchange mechanism of Keycloak. When using Standard Token Exchange V2, the syste… | 2026-11-06 |
| CVE-2026-96547 | MEDIUM | 6.5 | A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access … | 2026-11-06 |
| CVE-2026-97367 | MEDIUM | 6.4 | A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malic… | 2026-11-06 |
| CVE-2026-97848 | MEDIUM | 6.5 | A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management so… | 2026-11-06 |
| CVE-2026-120749 | MEDIUM | 6.2 | A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl mo… | 2026-11-06 |
| CVE-2026-73471 | MEDIUM | 6.1 | A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be … | 2026-11-06 |
| CVE-2026-73472 | MEDIUM | 6.1 | A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer ove… | 2026-11-06 |
| CVE-2026-73473 | MEDIUM | 5.5 | A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the e… | 2026-11-06 |
| CVE-2026-83493 | NA | N/A | A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request… | 2026-11-06 |
| CVE-2026-83494 | NA | N/A | A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhoo… | 2026-11-06 |
| CVE-2026-9797 | MEDIUM | 6.5 | A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privi… | 2026-11-06 |
| CVE-2026-118166 | MEDIUM | 4.8 | The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in i… | 2026-11-06 |
| CVE-2026-118423 | CRITICAL | 10.0 | The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submi… | 2026-11-06 |
| CVE-2026-119472 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David An… | 2026-11-06 |
| CVE-2026-119488 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim R… | 2026-11-06 |
| CVE-2026-119499 | HIGH | 7.5 | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-fl… | 2026-11-06 |
| CVE-2026-119516 | CRITICAL | 9.8 | Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appoin… | 2026-11-06 |
| CVE-2026-120844 | CRITICAL | 9.8 | Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorang… | 2026-11-06 |
| CVE-2026-121006 | NA | N/A | HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
Everything after the last ch… | 2026-11-06 |
| CVE-2026-121633 | MEDIUM | 5.3 | The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent t… | 2026-11-06 |
| CVE-2026-121636 | MEDIUM | 5.3 | The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifi… | 2026-11-06 |
| CVE-2026-121819 | NA | N/A | A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy chec… | 2026-11-06 |
| CVE-2026-121820 | NA | N/A | A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding … | 2026-11-06 |
| CVE-2026-121821 | NA | N/A | A vulnerability has been identified in armeria versions 0.84.0 through 1.42.0, where any-origin CORS policies … | 2026-11-06 |
| CVE-2026-121822 | NA | N/A | A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control fil… | 2026-11-06 |
| CVE-2026-121823 | NA | N/A | A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path norma… | 2026-11-06 |
| CVE-2026-121824 | NA | N/A | A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift mes… | 2026-11-06 |
| CVE-2026-39744 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lover… | 2026-11-06 |
| CVE-2026-65022 | MEDIUM | 6.3 | The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before renderi… | 2026-11-06 |
| CVE-2026-88799 | HIGH | 8.8 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership o… | 2026-11-06 |
| CVE-2026-88800 | CRITICAL | 9.1 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion r… | 2026-11-06 |
| CVE-2026-88801 | HIGH | 8.0 | The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check a capabilit… | 2026-11-06 |
| CVE-2026-103674 | NA | N/A | Invocation of the NetApp ONTAP special agent with the login password in the command line in Checkmk version 2.… | 2026-11-06 |
| CVE-2026-103682 | NA | N/A | Invocation of the Jolokia special agent with the login password in the command line in Checkmk versions 2.5.0 … | 2026-11-06 |
| CVE-2026-108018 | MEDIUM | 6.3 | The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A cl… | 2026-11-06 |
| CVE-2026-110291 | HIGH | 7.2 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripti… | 2026-11-06 |
| CVE-2026-118189 | MEDIUM | 6.4 | The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '… | 2026-11-06 |
| CVE-2026-120671 | MEDIUM | 6.4 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin f… | 2026-11-06 |
| CVE-2026-121794 | MEDIUM | 6.5 | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorizati… | 2026-11-06 |
| CVE-2026-122222 | MEDIUM | 6.4 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slug' pa… | 2026-11-06 |
| CVE-2026-123660 | NA | N/A | In Vulnerability-Lookup 5.5.1 up to but not including 6.4.1, a signed-in user could make the server allocate m… | 2026-11-06 |
| CVE-2026-19876 | MEDIUM | 6.1 | A reflected cross-site scripting (XSS) vulnerability in the login/SSO error page of INFINITT ULite 5.0.2.1_BN4… | 2026-11-06 |
| CVE-2026-19877 | HIGH | 7.5 | INFINITT ULite 5.0.2.1_BN48_20260528 and earlier protects image-share links with a low-entropy password and do… | 2026-11-06 |
| CVE-2026-109977 | MEDIUM | 4.9 | The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-base… | 2026-11-06 |
| CVE-2026-109994 | MEDIUM | 6.5 | The Eventin – Events Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable… | 2026-11-06 |
| CVE-2026-110776 | HIGH | 7.2 | The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting v… | 2026-11-06 |
| CVE-2026-115831 | MEDIUM | 4.3 | The VOD Infomaniak plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… | 2026-11-06 |
| CVE-2026-116592 | HIGH | 7.4 | undici is an HTTP client for Node.js. In versions 7.30.1 and 8.12.2 through 8.12.3, when an originless Agent c… | 2026-11-06 |
| CVE-2026-120222 | MEDIUM | 5.9 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the cach… | 2026-11-06 |
| CVE-2026-120415 | MEDIUM | 5.9 | undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect … | 2026-11-06 |