| CVE-2026-63155 | MEDIUM | 6.1 | Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers t… | 2026-11-13 |
| CVE-2026-63164 | MEDIUM | 6.5 | Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows… | 2026-11-13 |
| CVE-2026-63166 | MEDIUM | 6.1 | Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attac… | 2026-11-13 |
| CVE-2026-63167 | MEDIUM | 6.5 | Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated gener… | 2026-11-13 |
| CVE-2026-63170 | LOW | 3.7 | Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unau… | 2026-11-13 |
| CVE-2026-107398 | NA | N/A | Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerabili… | 2026-11-13 |
| CVE-2026-123177 | HIGH | 8.4 | A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path p… | 2026-11-13 |
| CVE-2026-123965 | CRITICAL | 9.9 | A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a f… | 2026-11-13 |
| CVE-2026-124041 | MEDIUM | 6.5 | Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL querie… | 2026-11-13 |
| CVE-2026-124666 | NA | N/A | Authentication bypass by spoofing vulnerability in Apache APISIX.
On a route where multi-auth falls back fr… | 2026-11-13 |
| CVE-2026-124679 | NA | N/A | Authentication bypass by spoofing vulnerability in Apache APISIX.
On routes using jwe-decrypt with strict: … | 2026-11-13 |
| CVE-2026-124680 | NA | N/A | Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX.
An unauthen… | 2026-11-13 |
| CVE-2026-124716 | NA | N/A | Incorrect Authorization vulnerability in Apache APISIX.
An authenticated user who holds any one of a route'… | 2026-11-13 |
| CVE-2026-124719 | NA | N/A | Authentication bypass by spoofing vulnerability in Apache APISIX.
When a Route's configured headers carry a… | 2026-11-13 |
| CVE-2026-124723 | NA | N/A | Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX.
With match_uri_… | 2026-11-13 |
| CVE-2026-124726 | NA | N/A | Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint… | 2026-11-13 |
| CVE-2026-126091 | HIGH | 7.5 | Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages contain… | 2026-11-13 |
| CVE-2026-128068 | MEDIUM | 5.3 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.… | 2026-11-13 |
| CVE-2026-128069 | MEDIUM | 4.7 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTM… | 2026-11-13 |
| CVE-2026-128070 | MEDIUM | 5.9 | Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent … | 2026-11-13 |
| CVE-2026-128071 | MEDIUM | 6.5 | Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server f… | 2026-11-13 |
| CVE-2026-128072 | LOW | 3.1 | Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack… | 2026-11-13 |
| CVE-2026-128074 | NA | N/A | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generat… | 2026-11-13 |
| CVE-2026-128075 | MEDIUM | 5.3 | Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP error… | 2026-11-13 |
| CVE-2026-128076 | LOW | 3.1 | Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until … | 2026-11-13 |
| CVE-2026-128077 | MEDIUM | 6.5 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request pat… | 2026-11-13 |
| CVE-2026-128078 | NA | N/A | GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated us… | 2026-11-13 |
| CVE-2026-128079 | NA | N/A | envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 an… | 2026-11-13 |
| CVE-2026-129139 | HIGH | 8.2 | paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSX… | 2026-11-13 |
| CVE-2026-129140 | MEDIUM | 5.4 | paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because Ima… | 2026-11-13 |
| CVE-2026-129141 | MEDIUM | 5.4 | paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService em… | 2026-11-13 |
| CVE-2026-129142 | MEDIUM | 5.4 | paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in paymen… | 2026-11-13 |
| CVE-2026-129143 | HIGH | 7.5 | paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail end… | 2026-11-13 |
| CVE-2026-129144 | MEDIUM | 5.4 | paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid art… | 2026-11-13 |
| CVE-2026-129151 | HIGH | 7.5 | SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view l… | 2026-11-13 |
| CVE-2026-129152 | MEDIUM | 5.3 | SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated a… | 2026-11-13 |
| CVE-2026-129153 | HIGH | 7.1 | SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to v… | 2026-11-13 |
| CVE-2026-129154 | MEDIUM | 6.1 | SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accep… | 2026-11-13 |
| CVE-2026-129155 | MEDIUM | 5.4 | DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filt… | 2026-11-13 |
| CVE-2026-129156 | MEDIUM | 5.4 | DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that all… | 2026-11-13 |
| CVE-2026-129157 | MEDIUM | 4.3 | ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows an… | 2026-11-13 |
| CVE-2026-129158 | MEDIUM | 5.4 | ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject sc… | 2026-11-13 |
| CVE-2026-129160 | MEDIUM | 6.5 | free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which pa… | 2026-11-13 |
| CVE-2026-129161 | HIGH | 7.4 | Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability … | 2026-11-13 |
| CVE-2026-129162 | MEDIUM | 5.9 | Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.pr… | 2026-11-13 |
| CVE-2026-129163 | MEDIUM | 5.4 | Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registere… | 2026-11-13 |
| CVE-2026-129164 | MEDIUM | 5.9 | Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to ac… | 2026-11-13 |
| CVE-2026-129165 | CRITICAL | 9.1 | Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoin… | 2026-11-13 |
| CVE-2026-129166 | MEDIUM | 6.5 | Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which in… | 2026-11-13 |
| CVE-2026-129167 | HIGH | 8.1 | Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulner… | 2026-11-13 |