| CVE-2026-74857 | HIGH | 8.8 | A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) … | 2026-11-12 |
| CVE-2026-75785 | HIGH | 7.2 | An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology … | 2026-11-12 |
| CVE-2026-76954 | CRITICAL | 9.8 | An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synolog… | 2026-11-12 |
| CVE-2026-77738 | MEDIUM | 4.3 | A server-side request forgery vulnerability in the Credential API in Synology DiskStation Manager (DSM) before… | 2026-11-12 |
| CVE-2026-81557 | MEDIUM | 5.4 | An improper neutralization of input during web page generation vulnerability in the DSMNotify in Synology Disk… | 2026-11-12 |
| CVE-2026-81558 | MEDIUM | 4.3 | A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-8… | 2026-11-12 |
| CVE-2026-81559 | MEDIUM | 4.3 | A missing authorization vulnerability in the TaskScheduler API in Synology DiskStation Manager (DSM) before 7.… | 2026-11-12 |
| CVE-2026-81584 | HIGH | 8.1 | An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synolog… | 2026-11-12 |
| CVE-2026-85098 | MEDIUM | 5.3 | A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5… | 2026-11-12 |
| CVE-2026-85101 | HIGH | 8.6 | An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation… | 2026-11-12 |
| CVE-2026-86343 | MEDIUM | 6.8 | An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DS… | 2026-11-12 |
| CVE-2026-87801 | MEDIUM | 6.5 | An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStatio… | 2026-11-12 |
| CVE-2026-88266 | MEDIUM | 4.3 | An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation … | 2026-11-12 |
| CVE-2026-92379 | MEDIUM | 5.4 | An improper neutralization of input during web page generation vulnerability in the Notification API in Synolo… | 2026-11-12 |
| CVE-2026-101107 | HIGH | 8.0 | An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be ex… | 2026-11-12 |
| CVE-2026-106027 | NA | N/A | The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor valida… | 2026-11-12 |
| CVE-2026-110041 | NA | N/A | The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading an… | 2026-11-12 |
| CVE-2026-110072 | NA | N/A | The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a g… | 2026-11-12 |
| CVE-2026-110959 | NA | N/A | The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creati… | 2026-11-12 |
| CVE-2026-118421 | NA | N/A | The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to o… | 2026-11-12 |
| CVE-2026-118531 | NA | N/A | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does … | 2026-11-12 |
| CVE-2026-118597 | NA | N/A | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authe… | 2026-11-12 |
| CVE-2026-119039 | NA | N/A | The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for… | 2026-11-12 |
| CVE-2026-119040 | NA | N/A | The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentica… | 2026-11-12 |
| CVE-2026-121498 | NA | N/A | The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before … | 2026-11-12 |
| CVE-2026-122003 | NA | N/A | The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a R… | 2026-11-12 |
| CVE-2026-123044 | NA | N/A | The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then… | 2026-11-12 |
| CVE-2026-123092 | NA | N/A | The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be writt… | 2026-11-12 |
| CVE-2026-124647 | NA | N/A | The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using… | 2026-11-12 |
| CVE-2026-124648 | NA | N/A | The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in… | 2026-11-12 |
| CVE-2026-124652 | NA | N/A | The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user b… | 2026-11-12 |
| CVE-2026-124653 | NA | N/A | The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credent… | 2026-11-12 |
| CVE-2026-124665 | NA | N/A | The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales re… | 2026-11-12 |
| CVE-2026-124814 | NA | N/A | The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension… | 2026-11-12 |
| CVE-2026-124815 | NA | N/A | The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion … | 2026-11-12 |
| CVE-2026-124817 | NA | N/A | The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating lea… | 2026-11-12 |
| CVE-2026-76792 | NA | N/A | The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step … | 2026-11-12 |
| CVE-2026-113408 | LOW | 3.3 | Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository… | 2026-11-12 |
| CVE-2026-12507 | CRITICAL | 9.1 | Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Pl… | 2026-11-12 |
| CVE-2026-12591 | CRITICAL | 9.9 | Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exp… | 2026-11-12 |
| CVE-2026-87772 | HIGH | 7.8 | Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About … | 2026-11-12 |
| CVE-2026-8331 | NA | N/A | An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows … | 2026-11-12 |
| CVE-2026-8332 | NA | N/A | A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with ac… | 2026-11-12 |
| CVE-2026-8333 | NA | N/A | A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated,… | 2026-11-12 |
| CVE-2026-118855 | NA | N/A | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated … | 2026-11-12 |
| CVE-2026-123133 | NA | N/A | Rejected reason: This CVE ID is a duplicate of CVE-2026-116518 and was never published. Both IDs were assigned… | 2026-11-12 |
| CVE-2026-125836 | HIGH | 8.8 | Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross S… | 2026-11-12 |
| CVE-2026-126991 | NA | N/A | The Wikidata Lookup expansion module (wiki.py) in MISP misp-modules contained a SPARQL injection vulnerability… | 2026-11-12 |
| CVE-2026-40820 | MEDIUM | 4.9 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData… | 2026-11-12 |
| CVE-2026-47832 | NA | N/A | The vulnerability lies in the way application credentials are handled within the BOSH deployment.
bosh-opensta… | 2026-11-12 |