| CVE-2026-129168 | MEDIUM | 6.1 | PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{… | 2026-11-13 |
| CVE-2026-129169 | MEDIUM | 5.4 | PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users… | 2026-11-13 |
| CVE-2026-129170 | MEDIUM | 6.1 | FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview,… | 2026-11-13 |
| CVE-2026-129171 | CRITICAL | 9.8 | NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote atta… | 2026-11-13 |
| CVE-2026-129172 | MEDIUM | 5.4 | EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoi… | 2026-11-13 |
| CVE-2026-63173 | MEDIUM | 5.4 | Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() … | 2026-11-13 |
| CVE-2026-97357 | NA | N/A | An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCo… | 2026-11-13 |
| CVE-2026-97358 | NA | N/A | An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom… | 2026-11-13 |
| CVE-2026-97361 | NA | N/A | There exists an improper privilege management vulnerability that could cause privilege escalation at the Space… | 2026-11-13 |
| CVE-2026-100403 | HIGH | 7.5 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1… | 2026-11-13 |
| CVE-2026-102537 | NA | N/A | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1… | 2026-11-13 |
| CVE-2026-102612 | HIGH | 8.1 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1… | 2026-11-13 |
| CVE-2026-104204 | NA | N/A | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, th… | 2026-11-13 |
| CVE-2026-128080 | MEDIUM | 5.8 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/in… | 2026-11-13 |
| CVE-2026-128081 | HIGH | 7.5 | AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, A… | 2026-11-13 |
| CVE-2026-128082 | HIGH | 7.5 | AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, A… | 2026-11-13 |
| CVE-2026-128083 | NA | N/A | Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process drive… | 2026-11-13 |
| CVE-2026-128084 | MEDIUM | 4.8 | sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby str… | 2026-11-13 |
| CVE-2026-128085 | MEDIUM | 5.3 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, an… | 2026-11-13 |
| CVE-2026-128086 | MEDIUM | 5.3 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, bagga… | 2026-11-13 |
| CVE-2026-128087 | LOW | 3.7 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version… | 2026-11-13 |
| CVE-2026-128088 | LOW | 2.2 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to ver… | 2026-11-13 |
| CVE-2026-129217 | NA | N/A | In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not valid… | 2026-11-13 |
| CVE-2026-43626 | NA | N/A | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority, replacedby CVE-202… | 2026-11-13 |
| CVE-2026-62975 | NA | N/A | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, th… | 2026-11-13 |
| CVE-2026-62976 | NA | N/A | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, th… | 2026-11-13 |
| CVE-2026-62977 | NA | N/A | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, th… | 2026-11-13 |
| CVE-2026-64675 | MEDIUM | 5.3 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 an… | 2026-11-13 |
| CVE-2026-67444 | NA | N/A | Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys… | 2026-11-13 |
| CVE-2026-68510 | NA | N/A | bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs d… | 2026-11-13 |
| CVE-2026-68541 | NA | N/A | PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensi… | 2026-11-13 |
| CVE-2026-82414 | HIGH | 8.8 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to bef… | 2026-11-13 |
| CVE-2026-97692 | HIGH | 7.7 | BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1… | 2026-11-13 |
| CVE-2026-127213 | MEDIUM | 6.5 | LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that… | 2026-11-13 |
| CVE-2026-127214 | HIGH | 8.5 | Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers… | 2026-11-13 |
| CVE-2026-127215 | HIGH | 8.1 | Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that a… | 2026-11-13 |
| CVE-2026-128089 | HIGH | 7.5 | dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not… | 2026-11-13 |
| CVE-2026-128100 | MEDIUM | 6.5 | Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case varia… | 2026-11-13 |
| CVE-2026-128116 | MEDIUM | 5.3 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to ver… | 2026-11-13 |
| CVE-2026-128117 | MEDIUM | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to ver… | 2026-11-13 |
| CVE-2026-128118 | HIGH | 7.5 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version… | 2026-11-13 |
| CVE-2026-128119 | MEDIUM | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version… | 2026-11-13 |
| CVE-2026-128120 | HIGH | 7.5 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version… | 2026-11-13 |
| CVE-2026-128121 | MEDIUM | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sv… | 2026-11-13 |
| CVE-2026-128122 | MEDIUM | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version… | 2026-11-13 |
| CVE-2026-128123 | MEDIUM | 5.9 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version… | 2026-11-13 |
| CVE-2026-68551 | NA | N/A | Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6… | 2026-11-13 |
| CVE-2026-68905 | HIGH | 8.2 | Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoint… | 2026-11-13 |
| CVE-2025-43867 | NA | N/A | - Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls… | 2026-11-13 |
| CVE-2026-127216 | MEDIUM | 6.5 | Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that all… | 2026-11-13 |