CVE Pulse

MEDIUM CVE-2026-96628 4.3 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.ma… Oct 16, 2026 HIGH CVE-2026-96627 8.8 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in back… Oct 16, 2026 HIGH CVE-2026-96626 8.5 — Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and… Oct 16, 2026 HIGH CVE-2026-68498 7.5 — StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Objec… Oct 16, 2026 HIGH CVE-2026-62439 7.0 — A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for im… Oct 16, 2026 MEDIUM CVE-2026-62438 6.1 — A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory conte… Oct 16, 2026 HIGH CVE-2026-49410 8.1 — OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 al… Oct 16, 2026 HIGH CVE-2026-111044 7.6 — Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted… Oct 16, 2026 N/A CVE-2026-108372 — — Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From… Oct 16, 2026 MEDIUM CVE-2026-96542 5.0 — Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1… Oct 16, 2026 MEDIUM CVE-2026-64862 6.5 — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoi… Oct 16, 2026 MEDIUM CVE-2026-55796 6.5 — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments… Oct 16, 2026 HIGH CVE-2026-108374 7.7 — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints fo… Oct 16, 2026 MEDIUM CVE-2026-108373 6.5 — ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in… Oct 16, 2026 N/A CVE-2026-96620 — — Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a s… Oct 16, 2026 N/A CVE-2026-69080 — — Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from… Oct 16, 2026 N/A CVE-2026-69077 — — Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services… Oct 16, 2026 N/A CVE-2026-69076 — — Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that a… Oct 16, 2026 N/A CVE-2026-68573 — — Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact… Oct 16, 2026 N/A CVE-2026-68572 — — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kyli… Oct 16, 2026 HIGH CVE-2026-61726 8.1 — Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, St… Oct 16, 2026 HIGH CVE-2026-59970 7.7 — Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, pa… Oct 16, 2026 MEDIUM CVE-2026-59966 5.7 — Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, ex… Oct 16, 2026 HIGH CVE-2026-59963 7.1 — Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, re… Oct 16, 2026 HIGH CVE-2026-30971 8.8 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40,… Oct 16, 2026 N/A CVE-2026-108743 — — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin… Oct 16, 2026 N/A CVE-2026-108709 — — Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly expos… Oct 16, 2026 HIGH CVE-2026-102834 7.5 — JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber… Oct 16, 2026 CRITICAL CVE-2026-102608 9.0 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manu… Oct 16, 2026 HIGH CVE-2026-102607 8.8 — ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() fu… Oct 16, 2026 MEDIUM CVE-2026-85977 5.3 — A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUM… Oct 16, 2026 MEDIUM CVE-2026-85231 6.5 — A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wra… Oct 16, 2026 MEDIUM CVE-2026-17491 5.4 — IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to impro… Oct 16, 2026 MEDIUM CVE-2026-17488 4.3 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper… Oct 16, 2026 LOW CVE-2026-17275 3.7 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transacti… Oct 16, 2026 MEDIUM CVE-2026-17073 5.4 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks… Oct 16, 2026 MEDIUM CVE-2026-17068 5.4 — IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement… Oct 16, 2026 MEDIUM CVE-2026-111793 4.3 — Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-type… Oct 16, 2026 MEDIUM CVE-2026-107674 5.1 — IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS us… Oct 16, 2026 HIGH CVE-2026-102917 7.8 — IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exp… Oct 16, 2026 N/A CVE-2025-66969 — — Integer overflow in OpenModSim ( Oct 16, 2026 N/A CVE-2025-55653 — — GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Pr… Oct 16, 2026 N/A CVE-2025-55640 — — A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to caus… Oct 16, 2026 MEDIUM CVE-2026-89098 5.5 — A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relyin… Oct 16, 2026 HIGH CVE-2026-81452 7.0 — Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A… Oct 16, 2026 MEDIUM CVE-2026-80092 5.3 — Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privi… Oct 16, 2026 HIGH CVE-2026-111723 8.8 — LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to m… Oct 16, 2026 HIGH CVE-2026-111722 8.1 — LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered u… Oct 16, 2026 MEDIUM CVE-2026-111721 5.4 — Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other wa… Oct 16, 2026 MEDIUM CVE-2026-111720 5.3 — fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that al… Oct 16, 2026 MEDIUM CVE-2026-111719 5.9 — Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that all… Oct 16, 2026 MEDIUM CVE-2026-111718 6.5 — AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the… Oct 16, 2026 MEDIUM CVE-2026-111717 4.3 — Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated empl… Oct 16, 2026 MEDIUM CVE-2026-111716 5.4 — Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modif… Oct 16, 2026 MEDIUM CVE-2026-111715 4.3 — Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employ… Oct 16, 2026 LOW CVE-2026-111714 3.1 — tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to bl… Oct 16, 2026 MEDIUM CVE-2026-111713 5.4 — tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefix… Oct 16, 2026 MEDIUM CVE-2026-111712 6.5 — Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers… Oct 16, 2026 CRITICAL CVE-2026-111711 9.8 — Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's us… Oct 16, 2026 HIGH CVE-2026-111710 7.5 — Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth()… Oct 16, 2026 MEDIUM CVE-2026-111709 5.4 — WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authen… Oct 16, 2026 CRITICAL CVE-2026-111708 9.8 — WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated a… Oct 16, 2026 MEDIUM CVE-2026-111707 5.3 — 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to r… Oct 16, 2026 HIGH CVE-2026-111706 7.5 — 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allow… Oct 16, 2026 MEDIUM CVE-2026-111705 4.3 — Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated member… Oct 16, 2026 CRITICAL CVE-2026-111704 9.8 — LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attac… Oct 16, 2026 MEDIUM CVE-2026-111703 6.3 — yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users… Oct 16, 2026 HIGH CVE-2026-111702 7.5 — ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attacker… Oct 16, 2026 HIGH CVE-2026-111701 7.0 — OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to… Oct 16, 2026 HIGH CVE-2026-111700 7.1 — WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL thro… Oct 16, 2026 MEDIUM CVE-2026-111699 4.8 — Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impe… Oct 16, 2026 MEDIUM CVE-2026-111698 6.5 — HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRechar… Oct 16, 2026 MEDIUM CVE-2026-111697 6.5 — HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeControlle… Oct 16, 2026 MEDIUM CVE-2026-111696 6.5 — data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServic… Oct 16, 2026 HIGH CVE-2026-111695 7.1 — Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows… Oct 16, 2026 MEDIUM CVE-2026-111694 5.3 — qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to acce… Oct 16, 2026 CRITICAL CVE-2026-111693 9.8 — DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated a… Oct 16, 2026 CRITICAL CVE-2026-111692 9.8 — DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers… Oct 16, 2026 HIGH CVE-2026-111691 7.4 — WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any t… Oct 16, 2026 CRITICAL CVE-2026-111690 9.8 — Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to… Oct 16, 2026 MEDIUM CVE-2026-111689 4.3 — Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user r… Oct 16, 2026 MEDIUM CVE-2026-111688 4.3 — Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role… Oct 16, 2026 CRITICAL CVE-2026-111687 9.8 — WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to… Oct 16, 2026 HIGH CVE-2026-111686 7.5 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL… Oct 16, 2026 HIGH CVE-2026-111685 7.5 — IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL… Oct 16, 2026 HIGH CVE-2026-111684 8.3 — Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to v… Oct 16, 2026 MEDIUM CVE-2026-111683 5.4 — Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to… Oct 16, 2026 MEDIUM CVE-2026-111682 6.5 — EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to… Oct 16, 2026 HIGH CVE-2026-111681 8.8 — EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manag… Oct 16, 2026 HIGH CVE-2026-111680 8.3 — APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to acc… Oct 16, 2026 MEDIUM CVE-2026-111679 5.4 — Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin… Oct 16, 2026 LOW CVE-2026-111678 3.3 — Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c beca… Oct 16, 2026 MEDIUM CVE-2026-111677 5.5 — Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted… Oct 16, 2026 MEDIUM CVE-2026-111676 4.3 — Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tic… Oct 16, 2026 HIGH CVE-2026-111675 7.4 — Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows… Oct 16, 2026 MEDIUM CVE-2026-111674 4.3 — Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other… Oct 16, 2026 CRITICAL CVE-2026-111673 9.8 — IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, de… Oct 16, 2026 MEDIUM CVE-2026-111672 4.3 — Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allow… Oct 16, 2026 HIGH CVE-2026-111671 7.1 — Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated user… Oct 16, 2026 MEDIUM CVE-2026-111670 4.3 — ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows aut… Oct 16, 2026