| CVE-2026-119481 | CRITICAL | 9.8 | Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Esca… | 2026-11-04 |
| CVE-2026-121144 | NA | N/A | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service a… | 2026-11-04 |
| CVE-2026-121145 | NA | N/A | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs… | 2026-11-04 |
| CVE-2026-121146 | NA | N/A | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication… | 2026-11-04 |
| CVE-2026-121147 | NA | N/A | This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL … | 2026-11-04 |
| CVE-2026-121373 | NA | N/A | The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes… | 2026-11-04 |
| CVE-2026-121620 | MEDIUM | 6.5 | CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauth… | 2026-11-04 |
| CVE-2026-121936 | MEDIUM | 6.5 | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attac… | 2026-11-04 |
| CVE-2026-121937 | LOW | 3.1 | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any… | 2026-11-04 |
| CVE-2026-121938 | MEDIUM | 5.3 | langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows auth… | 2026-11-04 |
| CVE-2026-121939 | HIGH | 8.1 | Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalU… | 2026-11-04 |
| CVE-2026-121940 | HIGH | 8.8 | Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows a… | 2026-11-04 |
| CVE-2026-121941 | HIGH | 7.8 | libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that… | 2026-11-04 |
| CVE-2026-121942 | MEDIUM | 6.1 | ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that a… | 2026-11-04 |
| CVE-2026-121943 | MEDIUM | 4.8 | Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_va… | 2026-11-04 |
| CVE-2026-121944 | MEDIUM | 5.5 | sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c tha… | 2026-11-04 |
| CVE-2026-121945 | HIGH | 7.6 | CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier t… | 2026-11-04 |
| CVE-2026-121946 | HIGH | 7.2 | zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in … | 2026-11-04 |
| CVE-2026-121970 | LOW | 3.7 | Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signa… | 2026-11-04 |
| CVE-2026-65555 | CRITICAL | 9.8 | Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-to… | 2026-11-04 |
| CVE-2026-118391 | NA | N/A | Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticat… | 2026-11-04 |
| CVE-2026-119745 | MEDIUM | 4.3 | MultiVendorX plugin for WordPress before 5.0.21 contains a missing authorization vulnerability that allows any… | 2026-11-04 |
| CVE-2026-121993 | MEDIUM | 4.3 | wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos… | 2026-11-04 |
| CVE-2026-100407 | MEDIUM | 4.4 | Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-w… | 2026-11-04 |
| CVE-2026-100408 | MEDIUM | 4.4 | Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:… | 2026-11-04 |
| CVE-2026-114627 | NA | N/A | Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTM… | 2026-11-04 |
| CVE-2026-119776 | NA | N/A | In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 p… | 2026-11-04 |
| CVE-2026-120421 | MEDIUM | 6.1 | In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when U… | 2026-11-04 |
| CVE-2026-121007 | NA | N/A | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a … | 2026-11-04 |
| CVE-2026-121008 | NA | N/A | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and… | 2026-11-04 |
| CVE-2026-121009 | NA | N/A | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function na… | 2026-11-04 |
| CVE-2026-121632 | NA | N/A | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escapi… | 2026-11-04 |
| CVE-2026-121637 | NA | N/A | An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback … | 2026-11-04 |
| CVE-2026-121638 | NA | N/A | An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on… | 2026-11-04 |
| CVE-2026-121639 | NA | N/A | A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote u… | 2026-11-04 |
| CVE-2026-121640 | NA | N/A | An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker wh… | 2026-11-04 |
| CVE-2026-122006 | CRITICAL | 9.8 | The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can all… | 2026-11-04 |
| CVE-2026-122007 | MEDIUM | 6.5 | Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that all… | 2026-11-04 |
| CVE-2026-122008 | MEDIUM | 5.0 | Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint… | 2026-11-04 |
| CVE-2026-39430 | NA | N/A | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session ma… | 2026-11-04 |
| CVE-2026-39431 | NA | N/A | On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service … | 2026-11-04 |
| CVE-2026-66736 | NA | N/A | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.… | 2026-11-04 |
| CVE-2026-106554 | NA | N/A | One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadr… | 2026-11-04 |
| CVE-2026-109518 | NA | N/A | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic… | 2026-11-04 |
| CVE-2026-119746 | MEDIUM | 5.9 | ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated … | 2026-11-04 |
| CVE-2026-121950 | MEDIUM | 6.5 | FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an R… | 2026-11-04 |
| CVE-2026-121951 | HIGH | 7.5 | FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input ev… | 2026-11-04 |
| CVE-2026-121952 | CRITICAL | 9.8 | FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set … | 2026-11-04 |
| CVE-2026-121953 | CRITICAL | 9.8 | FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name ch… | 2026-11-04 |
| CVE-2026-121954 | MEDIUM | 6.5 | FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context… | 2026-11-04 |