| CVE-2026-120149 | HIGH | 8.8 | Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary co… | 2026-11-12 |
| CVE-2026-120150 | HIGH | 8.8 | Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code … | 2026-11-12 |
| CVE-2026-120151 | HIGH | 8.8 | Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary cod… | 2026-11-12 |
| CVE-2026-120152 | MEDIUM | 4.3 | Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via lo… | 2026-11-12 |
| CVE-2026-120153 | HIGH | 7.2 | SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privi… | 2026-11-12 |
| CVE-2026-120154 | MEDIUM | 4.3 | Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applica… | 2026-11-12 |
| CVE-2026-123790 | NA | N/A | ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POS… | 2026-11-12 |
| CVE-2026-126996 | MEDIUM | 6.3 | A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_toke… | 2026-11-12 |
| CVE-2026-126997 | HIGH | 7.3 | A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of th… | 2026-11-12 |
| CVE-2026-126998 | HIGH | 7.3 | A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiC… | 2026-11-12 |
| CVE-2026-14661 | HIGH | 8.1 | External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve pers… | 2026-11-12 |
| CVE-2026-16237 | MEDIUM | 5.4 | Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INS… | 2026-11-12 |
| CVE-2026-16240 | LOW | 3.7 | Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compr… | 2026-11-12 |
| CVE-2026-18447 | HIGH | 8.8 | Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the … | 2026-11-12 |
| CVE-2026-6460 | HIGH | 8.8 | Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user r… | 2026-11-12 |
| CVE-2026-6467 | HIGH | 7.2 | Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE … | 2026-11-12 |
| CVE-2026-126329 | NA | N/A | Docker Sandboxes reuses existing state and configuration directories without verifying their ownership. If sbx… | 2026-11-12 |
| CVE-2026-126330 | NA | N/A | Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned… | 2026-11-12 |
| CVE-2026-127109 | NA | N/A | A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control… | 2026-11-12 |
| CVE-2026-127111 | HIGH | 7.4 | SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that a… | 2026-11-12 |
| CVE-2026-127121 | MEDIUM | 6.5 | SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote… | 2026-11-12 |
| CVE-2026-127131 | HIGH | 7.4 | SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that all… | 2026-11-12 |
| CVE-2026-127135 | MEDIUM | 4.3 | SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject … | 2026-11-12 |
| CVE-2026-127141 | MEDIUM | 6.5 | SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust … | 2026-11-12 |
| CVE-2026-127145 | MEDIUM | 4.3 | SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to ma… | 2026-11-12 |
| CVE-2026-19809 | LOW | 3.3 | The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an… | 2026-11-12 |
| CVE-2026-70641 | NA | N/A | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of C… | 2026-11-12 |
| CVE-2026-70642 | MEDIUM | 4.3 | ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app env… | 2026-11-12 |
| CVE-2026-91007 | HIGH | 7.8 | The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspe… | 2026-11-12 |
| CVE-2025-10698 | NA | N/A | Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Iden… | 2026-11-12 |
| CVE-2026-121876 | HIGH | 7.9 | A flaw was found in the interaction between systemd-gpt-auto-generator and
confidential computing guest VM im… | 2026-11-12 |
| CVE-2026-124691 | HIGH | 7.1 | In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attac… | 2026-11-12 |
| CVE-2026-124695 | HIGH | 7.1 | In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTM… | 2026-11-12 |
| CVE-2026-124696 | HIGH | 7.1 | In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sh… | 2026-11-12 |
| CVE-2026-124697 | HIGH | 7.1 | In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values a… | 2026-11-12 |
| CVE-2026-124698 | HIGH | 7.1 | In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who c… | 2026-11-12 |
| CVE-2026-126189 | MEDIUM | 5.3 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve rep… | 2026-11-12 |
| CVE-2026-126190 | HIGH | 7.5 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0, Soup Sieve repea… | 2026-11-12 |
| CVE-2026-126191 | HIGH | 7.5 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 3.0, the CSS_ESCAPES … | 2026-11-12 |
| CVE-2026-126192 | NA | N/A | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a deve… | 2026-11-12 |
| CVE-2026-126193 | MEDIUM | 5.3 | Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class se… | 2026-11-12 |
| CVE-2026-126835 | MEDIUM | 6.5 | The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentica… | 2026-11-12 |
| CVE-2026-126837 | HIGH | 7.4 | A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect … | 2026-11-12 |
| CVE-2026-127029 | HIGH | 7.5 | A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP… | 2026-11-12 |
| CVE-2026-127030 | HIGH | 7.5 | A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buff… | 2026-11-12 |
| CVE-2026-127202 | MEDIUM | 5.3 | MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthent… | 2026-11-12 |
| CVE-2026-127203 | MEDIUM | 5.4 | AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated w… | 2026-11-12 |
| CVE-2026-16052 | NA | N/A | The http.cookies.Morsel class allows separator semicolons in attribute
values
and includes them verbatim in al… | 2026-11-12 |
| CVE-2026-82032 | NA | N/A | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.… | 2026-11-12 |
| CVE-2026-82977 | NA | N/A | The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 … | 2026-11-12 |