| CVE-2026-102589 | HIGH | 7.1 | When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by … | 2026-11-11 |
| CVE-2026-106023 | NA | N/A | NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.
This … | 2026-11-11 |
| CVE-2026-107509 | MEDIUM | 6.5 | A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a sing… | 2026-11-11 |
| CVE-2026-109163 | NA | N/A | Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)
Th… | 2026-11-11 |
| CVE-2026-110289 | MEDIUM | 5.5 | A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loop… | 2026-11-11 |
| CVE-2026-110992 | MEDIUM | 6.5 | A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outsi… | 2026-11-11 |
| CVE-2026-111000 | HIGH | 7.1 | A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folde… | 2026-11-11 |
| CVE-2026-111024 | HIGH | 7.1 | A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through th… | 2026-11-11 |
| CVE-2026-119618 | NA | N/A | Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's… | 2026-11-11 |
| CVE-2026-123710 | CRITICAL | 9.8 | A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an aud… | 2026-11-11 |
| CVE-2026-124746 | MEDIUM | 5.5 | A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer bou… | 2026-11-11 |
| CVE-2026-126325 | CRITICAL | 9.0 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The v… | 2026-11-11 |
| CVE-2026-13721 | MEDIUM | 6.5 | A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders w… | 2026-11-11 |
| CVE-2026-14242 | MEDIUM | 6.5 | A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they … | 2026-11-11 |
| CVE-2026-44929 | NA | N/A | Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik.
This issue affects Apache XM… | 2026-11-11 |
| CVE-2026-71395 | NA | N/A | unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP.
This issue affects … | 2026-11-11 |
| CVE-2026-82014 | MEDIUM | 4.3 | Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboa… | 2026-11-11 |
| CVE-2026-85632 | CRITICAL | 9.1 | Missing authentication for critical function and Improper validation of integrity check value vulnerability in… | 2026-11-11 |
| CVE-2026-89326 | NA | N/A | Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check do… | 2026-11-11 |
| CVE-2026-100290 | LOW | 3.7 | The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and f… | 2026-11-11 |
| CVE-2026-105440 | MEDIUM | 6.5 | Missing authorization in the JSON-RPC web services interface
of Extreme Networks Switch Engine (EXOS) allows a… | 2026-11-11 |
| CVE-2026-115819 | MEDIUM | 4.8 | Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %… | 2026-11-11 |
| CVE-2026-124686 | MEDIUM | 5.4 | In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values… | 2026-11-11 |
| CVE-2026-64855 | HIGH | 8.2 | soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_enve… | 2026-11-11 |
| CVE-2026-110697 | CRITICAL | 9.9 | A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-cont… | 2026-11-11 |
| CVE-2026-116633 | HIGH | 7.1 | A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to pe… | 2026-11-11 |
| CVE-2026-119233 | NA | N/A | proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an u… | 2026-11-11 |
| CVE-2026-119234 | NA | N/A | mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could … | 2026-11-11 |
| CVE-2026-119235 | NA | N/A | proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only aft… | 2026-11-11 |
| CVE-2026-119236 | NA | N/A | An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that th… | 2026-11-11 |
| CVE-2026-119237 | NA | N/A | In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet bee… | 2026-11-11 |
| CVE-2026-119238 | LOW | 3.3 | A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local a… | 2026-11-11 |
| CVE-2026-119723 | NA | N/A | When parsing request variables such as query-string and form parameters, HHVM did not check that appending a n… | 2026-11-11 |
| CVE-2026-121737 | NA | N/A | When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped readin… | 2026-11-11 |
| CVE-2026-122043 | NA | N/A | repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notification… | 2026-11-11 |
| CVE-2026-124687 | HIGH | 7.1 | In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitBu… | 2026-11-11 |
| CVE-2026-124688 | HIGH | 7.1 | In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mappin… | 2026-11-11 |
| CVE-2026-124689 | HIGH | 7.1 | In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does n… | 2026-11-11 |
| CVE-2026-124690 | HIGH | 7.1 | In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filteri… | 2026-11-11 |
| CVE-2026-124692 | HIGH | 7.1 | In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeL… | 2026-11-11 |
| CVE-2026-124693 | HIGH | 7.1 | In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and Pivo… | 2026-11-11 |
| CVE-2026-124694 | HIGH | 7.1 | In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does … | 2026-11-11 |
| CVE-2026-126720 | NA | N/A | Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_m… | 2026-11-11 |
| CVE-2026-126722 | NA | N/A | Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, up… | 2026-11-11 |
| CVE-2026-126723 | NA | N/A | Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RP… | 2026-11-11 |
| CVE-2026-126724 | NA | N/A | Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default p… | 2026-11-11 |
| CVE-2026-77873 | HIGH | 7.3 | An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authentica… | 2026-11-11 |
| CVE-2026-77882 | HIGH | 7.8 | A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a lo… | 2026-11-11 |
| CVE-2026-89061 | HIGH | 7.8 | During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distrib… | 2026-11-11 |
| CVE-2026-106133 | MEDIUM | 6.3 | In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in… | 2026-11-11 |