| CVE-2026-12963 | HIGH | 7.4 | A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devi… | 2026-11-10 |
| CVE-2026-12964 | HIGH | 8.0 | A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.… | 2026-11-10 |
| CVE-2026-13312 | CRITICAL | 9.9 | A vulnerability that could allow an attacker to compromise a system.… | 2026-11-10 |
| CVE-2026-13387 | LOW | 3.5 | A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be red… | 2026-11-10 |
| CVE-2026-13409 | MEDIUM | 4.3 | The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw … | 2026-11-10 |
| CVE-2026-14542 | MEDIUM | 6.7 | The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege
… | 2026-11-10 |
| CVE-2026-14543 | LOW | 3.9 | The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, … | 2026-11-10 |
| CVE-2026-14918 | MEDIUM | 5.3 | The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead… | 2026-11-10 |
| CVE-2026-4762 | HIGH | 8.8 | A vulnerability to perform a privilege escalation attack on the server as a non-admin user.… | 2026-11-10 |
| CVE-2026-63282 | MEDIUM | 6.5 | Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, w… | 2026-11-10 |
| CVE-2026-63287 | MEDIUM | 6.5 | It was possible for an authenticated non-admin user to modify certain data objects without having the appropri… | 2026-11-10 |
| CVE-2026-63288 | HIGH | 8.3 | A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. Thi… | 2026-11-10 |
| CVE-2026-8372 | HIGH | 8.8 | A vulnerability that could allow an attacker to gain unauthorized access.… | 2026-11-10 |
| CVE-2026-9063 | MEDIUM | 6.7 | A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unau… | 2026-11-10 |
| CVE-2026-100386 | HIGH | 7.5 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions … | 2026-11-10 |
| CVE-2026-120513 | HIGH | 8.2 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPres… | 2026-11-10 |
| CVE-2026-76877 | HIGH | 8.1 | The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in ve… | 2026-11-10 |
| CVE-2026-84938 | HIGH | 7.2 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notifica… | 2026-11-10 |
| CVE-2026-93427 | HIGH | 7.2 | The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugi… | 2026-11-10 |
| CVE-2026-125652 | MEDIUM | 6.8 | A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and au… | 2026-11-10 |
| CVE-2026-106007 | MEDIUM | 5.3 | The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the… | 2026-11-10 |
| CVE-2026-106025 | MEDIUM | 5.3 | The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a… | 2026-11-10 |
| CVE-2026-120012 | HIGH | 7.5 | SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messa… | 2026-11-10 |
| CVE-2026-120013 | HIGH | 7.5 | The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to vers… | 2026-11-10 |
| CVE-2026-60035 | HIGH | 7.2 | A high privileged remote attacker can perform a code injection in the backends network auth function leading t… | 2026-11-10 |
| CVE-2026-60036 | HIGH | 7.2 | A high privileged remote attacker can perform a code injection in the backends patch activate function leading… | 2026-11-10 |
| CVE-2026-60037 | HIGH | 7.2 | A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer funct… | 2026-11-10 |
| CVE-2026-60038 | HIGH | 7.2 | A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function … | 2026-11-10 |
| CVE-2026-60039 | HIGH | 7.2 | A high privileged remote attacker can perform a code injection in the backends backup restore function leading… | 2026-11-10 |
| CVE-2026-60040 | HIGH | 7.5 | An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result… | 2026-11-10 |
| CVE-2026-60041 | HIGH | 8.1 | An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for executio… | 2026-11-10 |
| CVE-2026-60042 | MEDIUM | 5.3 | An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially… | 2026-11-10 |
| CVE-2026-60043 | CRITICAL | 9.3 | An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution… | 2026-11-10 |
| CVE-2026-60044 | HIGH | 7.5 | The backups created by the application use a weak static password allowing an unauthenticated remote attacker … | 2026-11-10 |
| CVE-2026-60045 | MEDIUM | 4.9 | A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a los… | 2026-11-10 |
| CVE-2026-60046 | HIGH | 7.5 | An unauthenticated remote attacker can perform password resets for any user with known username and email with… | 2026-11-10 |
| CVE-2026-104619 | HIGH | 7.8 | Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing… | 2026-11-10 |
| CVE-2026-124503 | MEDIUM | 4.3 | A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function valida… | 2026-11-10 |
| CVE-2026-119446 | NA | N/A | Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated at… | 2026-11-10 |
| CVE-2026-120286 | NA | N/A | Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allo… | 2026-11-10 |
| CVE-2026-120295 | NA | N/A | Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an aut… | 2026-11-10 |
| CVE-2026-120730 | NA | N/A | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API… | 2026-11-10 |
| CVE-2026-120997 | NA | N/A | Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in… | 2026-11-10 |
| CVE-2026-120999 | NA | N/A | Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web al… | 2026-11-10 |
| CVE-2026-125672 | MEDIUM | 6.6 | A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is co… | 2026-11-10 |
| CVE-2026-125703 | MEDIUM | 5.5 | A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted … | 2026-11-10 |
| CVE-2026-125704 | HIGH | 7.5 | A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text co… | 2026-11-10 |
| CVE-2026-95646 | HIGH | 8.0 | Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command in… | 2026-11-10 |
| CVE-2026-95651 | HIGH | 7.5 | Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSI… | 2026-11-10 |
| CVE-2026-101275 | NA | N/A | Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a… | 2026-11-10 |