CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-10-26 03:40 Perth time (AWST). Recent.

1756KEV listed
209Published, last 14 days
654Critical
981High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-108738Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled—2026-10-11—
CVE-2026-108737Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reuse password reset tokens as session crede—2026-10-11—
CVE-2026-108736Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED—2026-10-11—
CVE-2026-108735Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresse—2026-10-11—
CVE-2026-108734Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authe—2026-10-11—
CVE-2026-108733Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the—2026-10-11—
CVE-2026-108732Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the—2026-10-11—
CVE-2026-108731Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspac—2026-10-11—
CVE-2026-108730Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the works—2026-10-11—
CVE-2026-108729Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated atta—2026-10-11—
CVE-2026-108728Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by rea—2026-10-11—
CVE-2026-108727EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped A—2026-10-11—
CVE-2026-108726GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search —2026-10-11—
CVE-2026-108725Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated use—2026-10-11—
CVE-2026-108724Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected p—2026-10-11—
CVE-2026-108723answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks —2026-10-11—
CVE-2026-108722open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Logger.write_log_file in os_computer_use/lo—2026-10-11—
CVE-2026-108721Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerability that allows local MCP callers to bypas—2026-10-11—
CVE-2026-108720phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnet—2026-10-11—
CVE-2026-108719LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via—2026-10-11—
CVE-2026-108718Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynam—2026-10-11—
CVE-2026-108717Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console u—2026-10-11—
CVE-2026-108716mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and rec—2026-10-11—
CVE-2026-108715LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src —2026-10-11—
CVE-2026-108714MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory b—2026-10-11—
CVE-2026-108713SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and —2026-10-11—
CVE-2026-108712SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticate—2026-10-11—
CVE-2026-108711Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to r—2026-10-11—
CVE-2026-108710NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictio—2026-10-11—
CVE-2026-108708Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administ—2026-10-11—
CVE-2026-108707Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to ca—2026-10-11—
CVE-2026-108706eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated—2026-10-11—
CVE-2026-108705CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticat—2026-10-11—
CVE-2026-108704CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission che—2026-10-11—
CVE-2026-108703CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to su—2026-10-11—
CVE-2026-1087021Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated —2026-10-11—
CVE-2026-1087011Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /cont—2026-10-11—
CVE-2026-1087001Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by —2026-10-11—
CVE-2026-108699hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugin—2026-10-11—
CVE-2026-108698hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign sign—2026-10-11—

Previous121–160 of 209Next