| CVE-2026-123620 | HIGH | 7.5 | Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authe… | 2026-11-06 |
| CVE-2026-123621 | HIGH | 8.8 | Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unau… | 2026-11-06 |
| CVE-2026-123622 | MEDIUM | 6.1 | Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote a… | 2026-11-06 |
| CVE-2026-123624 | MEDIUM | 5.4 | ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated us… | 2026-11-06 |
| CVE-2026-123664 | MEDIUM | 5.4 | A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. T… | 2026-11-06 |
| CVE-2026-123665 | LOW | 2.8 | A weakness has been identified in kubescape up to 4.0.15. Impacted is the function GetWriter of the file core/… | 2026-11-06 |
| CVE-2026-123782 | MEDIUM | 4.3 | ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateF… | 2026-11-06 |
| CVE-2026-123783 | HIGH | 8.8 | Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code… | 2026-11-06 |
| CVE-2026-123784 | HIGH | 7.8 | Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows… | 2026-11-06 |
| CVE-2026-123785 | MEDIUM | 5.5 | Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that a… | 2026-11-06 |
| CVE-2026-123786 | HIGH | 8.5 | Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with … | 2026-11-06 |
| CVE-2026-53980 | HIGH | 8.1 | Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish… | 2026-11-06 |
| CVE-2026-59105 | CRITICAL | 9.8 | Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose p… | 2026-11-06 |
| CVE-2026-64894 | NA | N/A | Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManage… | 2026-11-06 |
| CVE-2026-87045 | HIGH | 7.5 | The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the sta… | 2026-11-06 |
| CVE-2026-111573 | NA | N/A | Incorrect permissions on the Checkmk Windows agent's data directory, caused by a race condition that discards … | 2026-11-06 |
| CVE-2026-121623 | NA | N/A | The Symfony Serializer component DataUriNormalizer::denormalize() matches the data: scheme with a case-sensiti… | 2026-11-06 |
| CVE-2026-121880 | NA | N/A | Authorization bypass through user-controlled key in the localhost port-proxy (/p//) in Posit Software, … | 2026-11-06 |
| CVE-2026-121881 | NA | N/A | SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Wo… | 2026-11-06 |
| CVE-2026-123623 | MEDIUM | 5.9 | Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that … | 2026-11-06 |
| CVE-2026-123675 | HIGH | 8.3 | A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affec… | 2026-11-06 |
| CVE-2026-123676 | MEDIUM | 5.3 | A vulnerability has been found in xxyopen/201206030 novel up to 3.5.0. This impacts the function BookServiceIm… | 2026-11-06 |
| CVE-2026-123677 | MEDIUM | 4.3 | A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of t… | 2026-11-06 |
| CVE-2026-123792 | NA | N/A | The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafte… | 2026-11-06 |
| CVE-2026-12067 | NA | N/A | Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unpri… | 2026-11-06 |
| CVE-2026-21834 | LOW | 3.1 | HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was m… | 2026-11-06 |
| CVE-2026-58141 | HIGH | 7.6 | Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console … | 2026-11-06 |
| CVE-2026-66981 | MEDIUM | 6.5 | HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header suppli… | 2026-11-06 |
| CVE-2026-66982 | LOW | 3.3 | HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields,… | 2026-11-06 |
| CVE-2026-66984 | LOW | 3.1 | HCL AION is affected by a vulnerability where certain application responses revealed internal server file syst… | 2026-11-06 |
| CVE-2026-66986 | LOW | 3.3 | HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inacti… | 2026-11-06 |
| CVE-2026-66987 | MEDIUM | 5.3 | HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repe… | 2026-11-06 |
| CVE-2026-80301 | NA | N/A | Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside th… | 2026-11-06 |
| CVE-2026-80302 | NA | N/A | Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privilege… | 2026-11-06 |
| CVE-2026-80303 | NA | N/A | An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allo… | 2026-11-06 |
| CVE-2026-90436 | NA | N/A | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthentic… | 2026-11-06 |
| CVE-2026-103984 | MEDIUM | 6.5 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, when limit_user_customer_visibility… | 2026-11-06 |
| CVE-2026-103985 | HIGH | 7.1 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.231, the profile form exposes the only_a… | 2026-11-06 |
| CVE-2026-104656 | HIGH | 7.3 | Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier… | 2026-11-06 |
| CVE-2026-104657 | HIGH | 7.5 | Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and … | 2026-11-06 |
| CVE-2026-106127 | MEDIUM | 4.1 | Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versi… | 2026-11-06 |
| CVE-2026-106128 | MEDIUM | 4.1 | Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through… | 2026-11-06 |
| CVE-2026-106134 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReac… | 2026-11-06 |
| CVE-2026-106135 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Softw… | 2026-11-06 |
| CVE-2026-106136 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Softwar… | 2026-11-06 |
| CVE-2026-106141 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo… | 2026-11-06 |
| CVE-2026-106142 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoRe… | 2026-11-06 |
| CVE-2026-106143 | MEDIUM | 5.4 | Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI … | 2026-11-06 |
| CVE-2026-106144 | MEDIUM | 4.1 | Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-… | 2026-11-06 |
| CVE-2026-118515 | NA | N/A | The Symfony Serializer component DataUriNormalizer handles only the exact types SplFileInfo, SplFileObject, an… | 2026-11-06 |