Recent changes
Records added, updated or removed by each sync (kept for 90 days). RSS feed
| Synced (UTC) | Change | CVE | Severity | Summary |
|---|---|---|---|---|
| 2026-10-21 10:32 | updated | CVE-2026-87689 | Critical 9.8 | Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints |
| 2026-10-21 10:32 | new | CVE-2026-87096 | Low 3.3 | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis... |
| 2026-10-21 10:32 | new | CVE-2026-87095 | Critical 9.1 | Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis... |
| 2026-10-21 10:32 | updated | CVE-2026-85683 | High 8.8 | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| 2026-10-21 10:32 | updated | CVE-2026-42504 | High 7.5 | Quadratic complexity in WordDecoder.DecodeHeader in mime |
| 2026-10-21 10:32 | updated | CVE-2026-33818 | High 7.5 | Enforce maximum recursion depth in encoding/asn1 |
| 2026-10-21 10:32 | updated | CVE-2026-14556 | Medium 5.4 | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer |
| 2026-10-21 10:32 | updated | CVE-2026-108496 | Medium 5.3 | WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability |
| 2026-10-21 10:32 | updated | CVE-2026-107447 | Medium 5.3 | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP and Forgeable Voter Identity |
| 2026-10-21 10:32 | updated | CVE-2026-105256 | Medium 5.3 | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| 2026-10-21 10:32 | updated | CVE-2026-104642 | Low 2.7 | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypass |
| 2026-10-21 10:32 | updated | CVE-2026-104641 | Medium 5.3 | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipient |
| 2026-10-21 10:32 | updated | CVE-2026-103301 | Medium 5.3 | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret |
| 2026-10-21 10:32 | updated | CVE-2026-101138 | Medium 5.3 | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist |
| 2026-10-21 10:32 | updated | CVE-2025-26625 | High 8.6 | Git LFS may write to arbitrary files via crafted symlinks |
| 2026-10-21 10:02 | updated | CVE-2026-6045 | Medium 5.4 | Heap buffer overflow in EMF+ gradient brush import |
| 2026-10-21 10:02 | updated | CVE-2026-15565 | High 7.5 | Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method |
| 2026-10-21 09:32 | updated | CVE-2026-70386 | High 8.5 | OnePlus OxygenOS improper neutralization of special elements vulnerability |
| 2026-10-21 09:32 | new | CVE-2026-110884 | High 7.1 | WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability |
| 2026-10-21 09:32 | new | CVE-2026-110370 | High 8.8 | WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability |
| 2026-10-21 09:32 | new | CVE-2026-110369 | High 8.8 | WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability |
| 2026-10-21 09:32 | new | CVE-2026-105923 | Medium 4.0 | Null-pointer dereference in QTriangulator reachable through VectorImage |
| 2026-10-21 09:32 | updated | CVE-2025-66178 | Medium 6.7 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0... |
| 2026-10-21 09:16 | new | CVE-2026-97206 | High 7.5 | DNS-over-QUIC (DoQ) path-migration can lead to use-after-free on multi-threaded deployments. |
| 2026-10-21 09:16 | new | CVE-2026-96405 | Medium 5.3 | Aggregate DNS name chained pointer decompression work leads to degradation of service. |
| 2026-10-21 09:16 | updated | CVE-2026-8743 | Medium 5.3 | Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id improper authorization |
| 2026-10-21 09:16 | new | CVE-2026-70387 | High 8.4 | OnePlus OxygenOS exposed dangerous method vulnerability |
| 2026-10-21 09:16 | new | CVE-2026-70386 | High 8.5 | OnePlus OxygenOS improper neutralization of special elements vulnerability |
| 2026-10-21 09:16 | updated | CVE-2026-58224 | Medium 6.5 | Samba: ctdb fails to do integrity checking of received packets |
| 2026-10-21 09:16 | new | CVE-2026-50106 | Medium 6.5 | Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. |
| 2026-10-21 09:16 | new | CVE-2026-35501 | Low 3.7 | Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record. |
| 2026-10-21 09:16 | updated | CVE-2026-14618 | Medium 5.3 | Open5GS AMF nnrf-handler.c amf_nnrf_handle_nf_discover denial of service |
| 2026-10-21 09:16 | updated | CVE-2026-10565 | Low 2.3 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition |
| 2026-10-21 09:16 | updated | CVE-2026-10157 | Medium 6.9 | Open5GS NGAP PathSwitchRequest Message ngap-handler.c improper authentication |
| 2026-10-21 09:16 | new | CVE-2026-109125 | Medium 5.3 | Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold' |