| CVE-2026-104615 | HIGH | 7.9 | A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions b… | 2026-10-30 |
| CVE-2026-105454 | NA | N/A | RT's automatic link creation for URLs in HTML ticket content does
not HTML-escape the URL it places in t… | 2026-10-30 |
| CVE-2026-105455 | NA | N/A | RTIR's ticket creation forms show the subject of the related
ticket when splitting a ticket or creating … | 2026-10-30 |
| CVE-2026-105456 | NA | N/A | RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through an… | 2026-10-30 |
| CVE-2026-116407 | MEDIUM | 5.4 | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorr… | 2026-10-30 |
| CVE-2026-117182 | NA | N/A | An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v… | 2026-10-30 |
| CVE-2026-117183 | NA | N/A | A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to … | 2026-10-30 |
| CVE-2026-117184 | NA | N/A | An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) v… | 2026-10-30 |
| CVE-2026-118238 | NA | N/A | The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture f… | 2026-10-30 |
| CVE-2026-119287 | HIGH | 8.0 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP reg… | 2026-10-30 |
| CVE-2026-119288 | HIGH | 7.0 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches re… | 2026-10-30 |
| CVE-2026-119289 | HIGH | 7.1 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWor… | 2026-10-30 |
| CVE-2026-119290 | HIGH | 7.5 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rend… | 2026-10-30 |
| CVE-2026-119291 | MEDIUM | 5.5 | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to… | 2026-10-30 |
| CVE-2026-119369 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid W… | 2026-10-30 |
| CVE-2026-119479 | MEDIUM | 5.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetF… | 2026-10-30 |
| CVE-2026-119699 | MEDIUM | 5.3 | WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows una… | 2026-10-30 |
| CVE-2026-119700 | MEDIUM | 5.3 | WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers… | 2026-10-30 |
| CVE-2026-119701 | MEDIUM | 5.3 | WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers t… | 2026-10-30 |
| CVE-2026-119702 | MEDIUM | 6.5 | WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allo… | 2026-10-30 |
| CVE-2026-119703 | MEDIUM | 4.8 | xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_… | 2026-10-30 |
| CVE-2026-119704 | MEDIUM | 6.8 | Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands … | 2026-10-30 |
| CVE-2026-119705 | MEDIUM | 5.3 | SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remot… | 2026-10-30 |
| CVE-2026-119706 | CRITICAL | 9.8 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that al… | 2026-10-30 |
| CVE-2026-119707 | HIGH | 7.1 | SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content … | 2026-10-30 |
| CVE-2026-119708 | MEDIUM | 6.5 | abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement downlo… | 2026-10-30 |
| CVE-2026-119709 | MEDIUM | 5.8 | Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-… | 2026-10-30 |
| CVE-2026-119710 | HIGH | 7.1 | PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users wi… | 2026-10-30 |
| CVE-2026-119711 | MEDIUM | 5.3 | PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated… | 2026-10-30 |
| CVE-2026-119712 | MEDIUM | 6.4 | PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url t… | 2026-10-30 |
| CVE-2026-119713 | HIGH | 8.8 | Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API ke… | 2026-10-30 |
| CVE-2026-119714 | MEDIUM | 6.5 | My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unau… | 2026-10-30 |
| CVE-2026-119715 | MEDIUM | 4.3 | NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticate… | 2026-10-30 |
| CVE-2026-119716 | HIGH | 8.1 | pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template auth… | 2026-10-30 |
| CVE-2026-119717 | HIGH | 8.1 | pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to… | 2026-10-30 |
| CVE-2026-119718 | HIGH | 7.8 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer ove… | 2026-10-30 |
| CVE-2026-119719 | HIGH | 7.8 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thu… | 2026-10-30 |
| CVE-2026-119720 | MEDIUM | 5.5 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna()… | 2026-10-30 |
| CVE-2026-119721 | MEDIUM | 6.1 | Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* acce… | 2026-10-30 |
| CVE-2026-119722 | HIGH | 7.8 | Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct()… | 2026-10-30 |
| CVE-2026-62141 | MEDIUM | 5.4 | Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly … | 2026-10-30 |
| CVE-2025-49602 | NA | N/A | An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role whi… | 2026-10-30 |
| CVE-2026-104623 | MEDIUM | 6.3 | A security vulnerability exists in the authorization handling for the local (management) cluster shell feature… | 2026-10-30 |
| CVE-2026-112816 | NA | N/A | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.… | 2026-10-30 |
| CVE-2026-115642 | HIGH | 8.3 | In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyo… | 2026-10-30 |
| CVE-2026-119116 | HIGH | 7.8 | A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample applicat… | 2026-10-30 |
| CVE-2026-119148 | MEDIUM | 6.5 | Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersona… | 2026-10-30 |
| CVE-2026-119298 | MEDIUM | 4.2 | croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.… | 2026-10-30 |
| CVE-2026-119299 | MEDIUM | 5.9 | gopacket provides packet processing capabilities for Go. Prior to 1.7.2, the SCTP chunk chain in layers/sctp.g… | 2026-10-30 |
| CVE-2026-119300 | MEDIUM | 6.5 | Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publicati… | 2026-10-30 |