| CVE-2026-106146 | HIGH | 8.6 | In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter proce… | 2026-11-12 |
| CVE-2026-106154 | HIGH | 8.6 | In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterP… | 2026-11-12 |
| CVE-2026-106472 | MEDIUM | 6.3 | Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus … | 2026-11-12 |
| CVE-2026-106475 | HIGH | 7.1 | The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the d… | 2026-11-12 |
| CVE-2026-107365 | NA | N/A | A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests … | 2026-11-12 |
| CVE-2026-117543 | NA | N/A | Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects … | 2026-11-12 |
| CVE-2026-117550 | NA | N/A | Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated … | 2026-11-12 |
| CVE-2026-117551 | NA | N/A | Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation o… | 2026-11-12 |
| CVE-2026-118495 | NA | N/A | Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in … | 2026-11-12 |
| CVE-2026-119275 | NA | N/A | Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An a… | 2026-11-12 |
| CVE-2026-120466 | NA | N/A | Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.… | 2026-11-12 |
| CVE-2026-120468 | NA | N/A | Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - … | 2026-11-12 |
| CVE-2026-120469 | NA | N/A | Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints… | 2026-11-12 |
| CVE-2026-120470 | NA | N/A | Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility che… | 2026-11-12 |
| CVE-2026-120471 | NA | N/A | Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.… | 2026-11-12 |
| CVE-2026-124700 | HIGH | 7.8 | In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists t… | 2026-11-12 |
| CVE-2026-124702 | HIGH | 7.8 | In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that a… | 2026-11-12 |
| CVE-2026-125324 | NA | N/A | Rejected reason: This CVE is a duplicate of another CVE.… | 2026-11-12 |
| CVE-2026-126196 | HIGH | 8.1 | pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol com… | 2026-11-12 |
| CVE-2026-126197 | HIGH | 8.8 | pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol com… | 2026-11-12 |
| CVE-2026-126198 | LOW | 3.1 | pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol com… | 2026-11-12 |
| CVE-2026-126199 | MEDIUM | 6.8 | pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol com… | 2026-11-12 |
| CVE-2026-126831 | MEDIUM | 5.5 | A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer … | 2026-11-12 |
| CVE-2026-127063 | NA | N/A | The
third-party RMM+ extension for ConnectWise ScreenConnect uses a static API
secret by default. The value ca… | 2026-11-12 |
| CVE-2026-127099 | MEDIUM | 5.9 | A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks be… | 2026-11-12 |
| CVE-2026-127100 | MEDIUM | 5.5 | A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can s… | 2026-11-12 |
| CVE-2026-127101 | MEDIUM | 5.5 | A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first ne… | 2026-11-12 |
| CVE-2026-127204 | HIGH | 7.5 | WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerab… | 2026-11-12 |
| CVE-2026-71363 | MEDIUM | 5.3 | A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /a… | 2026-11-12 |
| CVE-2026-81843 | MEDIUM | 6.5 | Grafana is an open-source platform for monitoring and observability.
When an Elasticsearch data source is con… | 2026-11-12 |
| CVE-2024-21954 | NA | N/A | Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not … | 2026-11-12 |
| CVE-2025-54501 | NA | N/A | Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory… | 2026-11-12 |
| CVE-2026-0004 | NA | N/A | A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute c… | 2026-11-12 |
| CVE-2026-0101 | NA | N/A | Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a… | 2026-11-12 |
| CVE-2026-0436 | NA | N/A | Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM… | 2026-11-12 |
| CVE-2026-117542 | NA | N/A | Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update… | 2026-11-12 |
| CVE-2026-117544 | NA | N/A | Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other… | 2026-11-12 |
| CVE-2026-120033 | NA | N/A | In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) e… | 2026-11-12 |
| CVE-2026-120467 | NA | N/A | Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyM… | 2026-11-12 |
| CVE-2026-121619 | NA | N/A | The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies… | 2026-11-12 |
| CVE-2026-126203 | MEDIUM | 6.1 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top o… | 2026-11-12 |
| CVE-2026-126204 | LOW | 3.7 | express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in Memor… | 2026-11-12 |
| CVE-2026-126838 | MEDIUM | 5.5 | A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management… | 2026-11-12 |
| CVE-2026-127119 | MEDIUM | 5.3 | Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler)… | 2026-11-12 |
| CVE-2026-127235 | MEDIUM | 6.1 | A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNM… | 2026-11-12 |
| CVE-2026-127236 | MEDIUM | 5.4 | An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Mer… | 2026-11-12 |
| CVE-2026-18379 | HIGH | 8.8 | A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achi… | 2026-11-12 |
| CVE-2024-21963 | NA | N/A | An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) page… | 2026-11-12 |
| CVE-2024-36344 | NA | N/A | Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with loca… | 2026-11-12 |
| CVE-2025-0043 | NA | N/A | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker … | 2026-11-12 |