Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 754 threats · Tuesday, Oct 27· last check 2026-11-04 06:37 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Tuesday, Oct 27

Most severe in everything

BREACHNO CVE YET

GMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortionOnamae.com Desktop Cloud3 talking

BREACHNO CVE YET

Magecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pagesConvertr1 talking

MALWARENO CVE YET

EXPLOITED IN THE WILD

Fake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)Firefox Add-ons (AMO)1 talking

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Dahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypassesDahua IP cameras

Tuesday, Oct 27

MALICIOUSDON'T INSTALLREMOVE ITMalicious code in trajmetrics (PyPI)trajmetricsPackage2026-10-27 23:47 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Surf Telecom BrazilTwilioVendor2026-10-27 23:23 UTCby status page–WHAT TO DO HIGH7.5Nuxt Ollama module leaks cloud API key into public page payloadPackage2026-06-20 07:17 UTCby EPSS–WHAT TO DO MEDIUM4.3ThorVG: undersized font buffer causes out-of-bounds read on loadPackage2026-06-19 04:05 UTCby EPSS–WHAT TO DO HIGH7.2GRR: database restore path traversal reads and deletes server filesPackage2026-06-19 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.1GRR reservation app: admin LDAP settings let attackers run PHP codePackage2026-06-19 16:17 UTCby EPSS–WHAT TO DO HIGH8.8Cronicle: low-privileged users can run jobs as rootPackage2026-06-19 16:07 UTCby EPSS–WHAT TO DO HIGH8.1GRR resource reservation app: reflected XSS via maj.php forcemaj parameterPackage2026-06-19 16:16 UTCby EPSS–WHAT TO DO MEDIUM5.7WebSub subscribers may reflect hub challenge as HTML, enabling script injectionOther2026-06-20 08:53 UTCby EPSS–WHAT TO DO MEDIUM6.0eMudhra: eight intermediate CA private keys compromised, certificates revoked2 talkingInfrastructure2026-10-27 23:17 UTCby InfraStack Analyst2talkingWHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-18326 was rejected and withdrawn by its numbering authorityOther2026-10-27 23:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome V8: memory corruption lets a crafted web page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: WebAudio memory corruption lets a crafted page run code in sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in FileSystem lets a web page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in WTF lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: crafted HTML page can escape the sandbox and run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Skia input validation flaw lets crafted page run code in sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Paint lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Cache lets a crafted page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Skia memory corruption lets a crafted web page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Turbolev lets crafted page run code in sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Payments lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDGoogle Chrome: Skia input validation flaw lets crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in FileSystem lets a web page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in compositing lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: PDFium use-after-free lets a crafted web page run codePackage2026-10-27 23:17 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDGoogle Chrome: use-after-free in Layout runs code via crafted pageOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: ReadingList input validation flaw lets a crafted page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: out-of-bounds write in Editing lets a web page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Modularization lets a web page run codeInfrastructure2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Skia memory corruption lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Animation lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDChrome: use-after-free in Animation lets a crafted page run code in sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: Forms access control flaw lets a web page bypass origin policyRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Headless input validation flaw lets crafted HTML run code in sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Mac: crafted HTML page can run code inside sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: ImageCapture use-after-free lets a web page run code in the sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: missing authorization in Video lets pages bypass origin policyOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: compositing input flaw lets a crafted page escape the sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDChrome: FileAPI input validation flaw lets crafted page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Windows: use-after-free lets a crafted page run code in sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Mac: ANGLE input validation flaw lets crafted pages run codeVendor2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: WebRTC input validation flaw lets a crafted page run code in sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Media lets crafted page run code in sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: ANGLE memory corruption lets a crafted page read sandbox memoryRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Android: input validation flaw lets crafted page escape sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome V8: memory corruption lets a crafted web page run codeRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: Skia memory corruption lets a crafted web page read sandbox memoryOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome V8: improper access control lets a crafted page read memoryPackage2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: HTML memory corruption lets a crafted page run codeOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome V8: crafted HTML page can run code outside the sandboxOther2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: crafted SVG handling lets a web page run code in the sandboxRuntime2026-10-27 23:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Android: UI input validation flaw lets a crafted page run codeRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Video lets a crafted page run codeOther2026-10-27 23:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDChrome: memory corruption in Paint lets crafted page run codeRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: memory corruption in Media lets crafted web page run codeRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Windows: input validation flaw lets crafted page escape sandboxRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome on Android: input validation flaw lets crafted page escape sandboxRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: SVG use-after-free lets a crafted web page run codeOther2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Paint lets crafted page run code in sandboxRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDGoogle Chrome: memory corruption in FileSystem lets a web page run codeRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: memory corruption in Turbolev lets a crafted page escape the sandboxRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDChrome: crafted SVG input lets a web page run code in sandboxRuntime2026-10-27 23:16 UTCby EPSS–WHAT TO DO MEDIUM6.9a2a-js: race condition in task status updates before 1.2.0Package2026-10-27 23:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-112155 was rejected and withdrawn by its numbering authorityOther2026-10-27 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111563 withdrawn by its numbering authority, no flawOther2026-10-27 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111479 withdrawn by its CVE Numbering Authority, no flawOther2026-10-27 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111467 withdrawn by its numbering authority, no flaw describedOther2026-10-27 23:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2025-12534 was rejected and withdrawn by its numbering authorityOther2026-10-27 23:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Failures Between a Subset of Twilio Long Codes and Multiple Networks in PortugalTwilioVendor2026-10-27 23:06 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ccsseecc-crypto-toolkit (npm)ccsseecc-crypto-toolkitPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in csec-crypto-toolkit (npm)csec-crypto-toolkitPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in csec-form-validatorr (npm)csec-form-validatorrPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ccsec-crypto-toolkit (npm)ccsec-crypto-toolkitPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in csec-form-validator (npm)csec-form-validatorPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ccsseecc-form-validator (npm)ccsseecc-form-validatorPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ccsec-form-validator (npm)ccsec-form-validatorPackage2026-10-27 23:04 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Voice Call Failures from a Subset of Twilio Phone Numbers to ArgentinaTwilioVendor2026-10-27 22:28 UTCby status page–WHAT TO DO LOWINCIDENTCloudflare: Network Error Log Processing UnavailableCloudflareVendor2026-10-27 22:21 UTCby status page–WHAT TO DO HIGH7.5Microsoft Edge: type confusion lets a remote attacker run codePackage2026-10-27 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Asterisk: ast_loggrabber runs a script planted in world-writable /tmpRuntime2026-10-27 22:17 UTCby EPSS–WHAT TO DO LOW2.3Asterisk: SMS dialplan application overflows buffers, allowing memory corruption or crashPackage2026-10-27 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.0Asterisk: Codec2 decoder heap overflow lets authenticated SIP callers corrupt memoryRuntime2026-10-27 22:17 UTCby EPSS–WHAT TO DO HIGH8.2Asterisk: unbounded sscanf in MWI NOTIFY lets unauthenticated packets crash SIPPackage2026-10-27 22:17 UTCby EPSS–WHAT TO DO HIGH7.0Asterisk: CEL logging can run arbitrary SQL from untrusted dialplan dataRuntime2026-10-27 22:17 UTCby EPSS–WHAT TO DO HIGH7.5Asterisk: malformed Q.931 party-number in chan_ooh323 crashes the PBXPackage2026-06-25 15:55 UTCby EPSS–WHAT TO DO HIGHINCIDENTDigitalOcean: Kubernetes Cluster Management OperationsDigitalOceanVendor2026-10-27 22:14 UTCby status page–WHAT TO DO LOWINCIDENTTwilio: Elevated 500 Errors Affecting Programmable Messaging APITwilioVendor2026-10-27 21:44 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in agentenact (npm)agentenactPackage2026-10-27 21:39 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: MMS Delivery Delays from a Subset of Twilio Long Codes to C-Spire United StatesTwilioVendor2026-10-27 21:31 UTCby status page–WHAT TO DO HIGH8.8Microsoft Edge: type confusion lets a network attacker run codePackage2026-10-27 21:19 UTCby EPSS–WHAT TO DO HIGH8.8Microsoft Edge: double free lets a remote attacker run codeOther2026-10-27 21:19 UTCby EPSS–WHAT TO DO HIGH7.5Asterisk: read-only ARI user can load modules and run codePackage2026-06-25 15:55 UTCby EPSS–WHAT TO DO HIGH7.5Asterisk: NULL pointer dereference in AMI over HTTP crashes the serverPackage2026-10-27 21:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-39928 was rejected by its numbering authority, no flawOther2026-10-27 21:18 UTCby NVD–WHAT TO DO LOW2.3pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)pageantPackage2026-10-25 16:50 UTCby EPSS–FIX 0.2.5 MEDIUM4.3russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)russhPackage2026-10-25 16:50 UTCby EPSS–FIX 0.65 MEDIUM4.3russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsrusshPackage2026-10-25 16:49 UTCby EPSS–FIX 0.65 LOW3.3russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesrusshPackage2026-10-25 16:49 UTCby EPSS–FIX 0.65.0 MEDIUM5.3Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypasscrassPackage2026-10-21 21:36 UTCby EPSS–FIX 1.0.8 CRITICAL9.8MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modulesmlflowPackage2026-10-09 08:20 UTCby EPSS–FIX 3.17.0 LOWNOT SCOREDAvoid quadratic complexity when coalescing text nodes in html in golang.org/x/netgolang.org/x/netPackage2026-10-27 21:16 UTCby EPSS–FIX 0.62.0 NOT SCOREDNOT SCOREDCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/netgolang.org/x/netPackage2026-10-27 21:16 UTCby EPSS–FIX 0.62.0 LOWINCIDENTCloudflare: Elevated Cloudflare Access API ErrorsCloudflareVendor2026-10-27 21:13 UTCby status page–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDMagecart skimmer planted in Convertr's self-hosted Plausible analytics script steals card data on Brazilian checkout pagesConvertr1 talkingVendor2026-10-27 20:57 UTCby InfraStack Analyst1talkingWHAT TO DO HIGH8.7dd-trace: ReDOS in URL query string obfuscationdd-tracePackage2026-10-08 16:30 UTCby EPSS–FIX 5.131.1 MEDIUM6.3OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationopentelemetry-propagator-jaegerPackage2026-10-05 15:39 UTCby EPSS–FIX 1.45.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mw-communication-client (npm)mw-communication-clientPackage2026-10-27 20:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mui-wrapper-x-date-pickers (npm)mui-wrapper-x-date-pickersPackage2026-10-27 20:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mw-test-utils (npm)mw-test-utilsPackage2026-10-27 20:45 UTCby osv-malicious–UNINSTALL MEDIUM6.5MLflow CrewAI autologging records LLM provider API keys in logged trace spansmlflowAI agents & MCP2026-10-13 03:44 UTCby EPSS–FIX 3.17.0 HIGH7.5MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version sourcemlflowAI agents & MCP2026-10-13 05:56 UTCby EPSS–FIX 3.17.0 HIGH5.9follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsfollow-redirectsPackage2026-10-25 21:29 UTCby EPSS–FIX 1.16.2 HIGH8.1CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5Package2026-09-16 08:02 UTCby EPSS–FIX 47.7.4 LOW3.1CKEditor: Cross-site scripting (XSS) in the engine packageckeditor5Package2026-09-16 08:02 UTCby EPSS–FIX 47.7.4 MEDIUM6.5Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasmcpAI agents & MCP2026-09-28 13:14 UTCby EPSS–FIX 2.2.0 MEDIUM5.9Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesmcpAI agents & MCP2026-10-02 20:42 UTCby EPSS–FIX 2.2.0 MEDIUM6.8Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource servermcpAI agents & MCP2026-10-05 16:00 UTCby EPSS–FIX 2.2.0 HIGH8.7MembershipWorks WordPress plugin leaks member-only content via REST APIPackage2026-10-27 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.1Sunhillo SureLine: forged cookie login bypass gives unauthenticated remote rootVendor2026-10-27 20:17 UTCby EPSS–WHAT TO DO HIGH8.8Sunhillo SureLine: web account can run root commands via networkDiag.cgiSureLineInfrastructure2026-10-27 20:17 UTCby InfraStack Analyst–FIX 9.1.5 HIGH8.7Sunhillo SureLine: unauthenticated path traversal reads root-owned filesInfrastructure2026-10-27 20:17 UTCby EPSS–WHAT TO DO LOW2.0Python: lenient integer parsing misreads HTTP response body and chunk framingRuntime2026-10-27 19:26 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dsh-vm-tester (npm)dsh-vm-testerPackage2026-10-27 20:02 UTCby osv-malicious–UNINSTALL HIGHCAMPAIGNEXPLOITEDbonto.io wallet extensionsFake Phantom, Jupiter and Bitget wallet extensions on Firefox Add-ons steal recovery phrases and private keys and drain funds (bonto.io)Firefox Add-ons (AMO)1 talkingPackage2026-10-27by InfraStack Analyst1talkingWHAT TO DO MEDIUMNOT SCOREDThunderbird: Matrix login trusts server-supplied file URL, leaking Windows NTLM credentialsPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDThunderbird: news links make it connect to arbitrary hosts and send commandsOther2026-10-27 19:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDThunderbird: RSS feed redirect reads local files and leaks NTLM credentialsPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDThunderbird: calendar discovery accepts remote and local locations, leaking NTLMPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDThunderbird on Windows: crafted email leaks NTLM credentials to attacker SMB serverPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDThunderbird: crafted email can leak another message from the same folderPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDThunderbird: OpenPGP key attachments leak requests and NTLM credentials on displayPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO MEDIUM6.1MISP Guard: incomplete tag check lets higher-classified data pass feed policyOther2026-10-27 19:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDStrapi: webhook redirects let attackers reach internal network addressesPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDStrapi content-manager: preview URL endpoint skips content-scope authorization checksPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDStrapi review-workflows: updates skip the document's update-rights checkPackage2026-10-27 19:17 UTCby EPSS–WHAT TO DO HIGH7.5MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length@modelcontextprotocol/sdkAI agents & MCP2026-10-27 19:02 UTCby GitHub Advisories–FIX 1.30.1 HIGH7.1CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesgithub.com/ctfer-io/terraform-provider-ctfdPackage2026-10-01 13:09 UTCby EPSS–FIX 2.8.2 HIGH7.8X.Org X Server: XKB double free lets a client run codeInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.5Tanium Provision: denial of service flaw, details unknownVendor2026-10-27 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Tanium Provision: SQL injection flaw, details and fix unknownVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH8.1Asterisk: read-only ARI user can write files through setChannelVarPackage2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.1Asterisk: XMPP namespace handling lets an authenticated peer overflow the stackPackage2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Grafana: folder admin check lets users list deleted dashboards from other foldersRuntime2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDNextChat: remote plugin schema runs attacker JavaScript in the Plugin EditorAI agents & MCP2026-10-27 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGnuPG for Windows: default ProgramData permissions let local users plant configPackage2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3redux-devtools: Remotedev server evalAction lets local input inject codePackage2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.5PHP Travel Agency System: contact form enables remote SQL injectionOther2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.5php-travel-agency-system: SQL injection in traceapplication.php lets remote attackers query dataphp-travel-agency-systemOther2026-10-27 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directorygithub.com/gtsteffaniak/filebrowser/backendPackage2026-08-15 00:24 UTCby EPSS–FIX 0.0.0-20260814233832-4126edeb07a0 MEDIUM6.4HomeBox: notifier redirects bypass SSRF checks, reaching internal addressesPackage2026-10-17 16:15 UTCby EPSS–WHAT TO DO MEDIUM5.4Neko: Authorization bypass in legacy WebRTC input handlinggithub.com/m1k1o/neko/serverOther2026-08-28 08:14 UTCby EPSS–FIX 0.0.0-20260805142851-395ca1a6f62b MEDIUM5.8Vaultwarden: favicon fetch reaches internal addresses via IP-literal URLsPackage2026-10-03 20:05 UTCby EPSS–WHAT TO DO MEDIUM5.3OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsopenwisp-controllerPackage2026-10-23 21:57 UTCby EPSS–FIX 1.3.2 HIGH8.8Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plangithub.com/runatlantis/atlantisRuntime2026-08-25 17:47 UTCby EPSS–FIX 0.47.1 HIGH7.5Tanium Enforce: compression bomb flaw; sources give no fix detailsVendor2026-10-27 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3Tanium Enforce: improper access controls flaw, details not publishedVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Tanium Enforce: uncontrolled resource consumption lets requests exhaust resourcesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Tanium Enforce: denial of service flaw, patch from vendorVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Tanium Enforce: denial of service flaw, details unknownVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.5Tanium Enforce: uncontrolled resource consumption lets attackers exhaust resourcesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.1Tanium Enforce: improper output sanitization flaw, details unknownTanium EnforceVendor2026-10-27 18:17 UTCby InfraStack Analyst–FIX 2.9.736 HIGH7.1Tanium Comply: improper output sanitization flaw, details unknownTanium ComplyVendor2026-10-27 18:17 UTCby InfraStack Analyst–FIX 2.32.263 NOT SCOREDNOT SCOREDWithdrawn CVE-2026-111054 is a duplicate of CVE-2026-112374Other2026-10-27 18:17 UTCby NVD–WHAT TO DO LOW2.5Tanium Threat Response client extension has a use-after-free flawVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Tanium Threat Response client: link resolution flaw before file accessVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO LOW3.3Tanium Threat Response Client Extension: infinite loop can stall the clientVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO LOW3.6Tanium Threat Response client extension leaks information to local usersOther2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH8.8Tanium Threat Response: unauthorized code execution flaw, patched by vendorThreat ResponseOther2026-10-27 18:17 UTCby InfraStack Analyst–FIX 4.9.476 MEDIUM4.2Tanium Threat Response: sensitive data written into log filesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Tanium Stream Client Extension accepts improperly validated certificatesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.6Tanium Reputation: sensitive data written into log filesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Tanium Server: information disclosure flaw, fixed in a vendor updateVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.6Tanium Server: incorrect privilege assignment lets low-privilege users gain rightsVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO LOW2.7Tanium Server: insufficient logging weakness lets attackers hide activityVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Tanium Server: denial of service flaw lets attackers crash the serviceOther2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Tanium: Performance Client Extension can be made to consume unbounded resourcesVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Tanium Patch: SQL injection flaw, exact impact not yet publishedVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.8Tanium Index: heap buffer overflow in an unspecified componentOther2026-10-27 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Tanium End-User Notifications: local privilege escalation to higher system rightsVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH7.8Tanium End-User Notifications: local privilege escalation to higher system rightsTanium End-User Notifications (end-user-cx)Vendor2026-10-27 18:17 UTCby InfraStack Analyst–FIX 1.8.47 HIGH7.8Tanium End-User Notifications: local privilege escalation to higher rightsVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH8.8Tanium Certificate Manager: unauthorized code execution flaw patchedTanium Certificate ManagerVendor2026-10-27 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3Tanium Comply: improper access controls flaw, details not publishedVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.0Tanium Comply: improper access controls flaw, medium severity, details pendingVendor2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3TP-Link RE305 V3: unauthenticated region change disrupts Wi-Fi serviceInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.9TP-Link RE305 V3: local command injection in tmpServer gives rootInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO HIGH8.7TP-Link RE305 V3: TDDP v2 weak key lets local attacker run root commandsInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.1TP-Link RE305 V3: weak password-recovery codes let attackers reset admin passwordInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.9TP-Link Archer and RE305 range extenders: hard-coded backup key exposes passwordsInfrastructure2026-10-27 18:17 UTCby EPSS–WHAT TO DO LOWINCIDENTTwilio: Retroactive Issue with Organization Pages in New ConsoleTwilioVendor2026-10-27 17:36 UTCby status page–WHAT TO DO MEDIUM4.6Whiteboard app: SSRF leaks another user's JWT token via Chrome DevToolsOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Group members can create share links despite administrator restrictionOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Team resource API leaks resource names and IDs to non-membersPackage2026-10-27 17:17 UTCby EPSS–WHAT TO DO LOW3.3Nextcloud Tables: share-listing endpoint leaks recipients to read-only usersOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Document labeling flaw lets docx or odt files with # in name skip confidential markingOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.3App passwords could skip password confirmation on sensitive account endpointsOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO LOW3.5Public shared collective let link recipients create pagesOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO HIGH7.5Nextcloud federated share endpoint lets attackers write rows and cause denial of servicenextcloud-serverOther2026-10-27 10:47 UTCby InfraStack Analyst–FIX 34.0.2 LOW3.5Collabora-style WOPI endpoint leaks configuration details to user tokensOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO HIGH7.5Asterisk: H.323 trace logging overflow lets a remote packet crash the processPackage2026-10-27 17:17 UTCby EPSS–WHAT TO DO LOW2.3Asterisk: crafted T.140 RED packets overflow heap buffer via chan_sipRuntime2026-10-27 17:17 UTCby EPSS–WHAT TO DO HIGH7.7Asterisk: corrupted Speex audio file overflows heap and crashes serverRuntime2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.9Asterisk: crafted UNISTIM packet overflows phone number field, crashing serverRuntime2026-10-27 17:17 UTCby EPSS–WHAT TO DO LOW2.3Asterisk: T.140 RED out-of-bounds write via chan_sip text supportPackage2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Asterisk: crafted SIP NOTIFY crashes PBX via buffer over-readPackage2026-10-27 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Knative pkg: unbounded webhook body lets one request exhaust controller memoryPackage2026-06-04 16:49 UTCby EPSS–WHAT TO DO MEDIUM5.5Adobe Substance3D Painter: out-of-bounds read leaks memory via malicious fileOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO HIGH7.8Substance3D Painter: stack buffer overflow lets a malicious file run codeSubstance 3D PainterOther2026-10-27 17:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.6Adobe Connect: code injection lets a crafted link run code as the userAdobe Connect Desktop (Windows)Vendor2026-10-27 17:17 UTCby InfraStack Analyst–FIX 2026.9.61 HIGH7.5php-travel-agency-system: SQL injection in admin customer page lets attackers read dataOther2026-10-27 17:17 UTCby EPSS–WHAT TO DO HIGH7.5php-travel-agency-system: SQL injection in admin customer search lets attackers query the databasePackage2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.5php-travel-agency-system: employee photo upload accepts unrestricted filesphp-travel-agency-systemPackage2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.5TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationtinymcePackage2026-10-06 04:00 UTCby EPSS–FIX 8.9.3 MEDIUM6.5systeminformation has prototype pollution in `networkStats()` via the interface namesysteminformationPackage2026-10-19 16:08 UTCby EPSS–FIX 5.33.13 LOW3.3systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netsysteminformationPackage2026-10-19 16:10 UTCby EPSS–FIX 5.33.14 HIGH8.8Authlib RFC 7592 examples omit registration-access-token client bindingAuthlibPackage2026-10-14 14:22 UTCby EPSS–FIX 1.9.1 HIGH8.7EPICS Base: network message length check lets reads overrun buffersInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH8.7EPICS Base: network message validation flaw reads past buffer boundsInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH8.8EPICS Base: integer overflow in protocol parsing enables out-of-bounds memory writeInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITEPICS Base: integer overflow in network requests corrupts memory, enables code executionInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.8Autodesk Fusion: crafted DLL loaded via TextCommands.LoadDll runs codeOther2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH8.2Kerio Connect Webmail: stored XSS via SVG attachment steals sessionsPackage2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.5libXi: malicious X server causes heap overflow via DEVICE_ENABLE replyInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.5libXi: heap buffer overflow in DEVICE_RESOLUTION handling from malicious X serverInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO MEDIUM6.5libXtst: malformed X server reply causes client endless loopInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO CRITICAL9.1CDP Coordinator Service: unauthenticated attacker bypasses authorization checksVeeam Backup & ReplicationOther2026-10-27 17:16 UTCby InfraStack Analyst–FIX 13.1.2.57 MEDIUM5.9Backup server: relative path traversal lets a restore operator write arbitrary filesInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO MEDIUM5.9Backup server: restore role can write files outside target pathInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO CRITICAL9.1eMudhra intermediate CA private keys compromised, enabling TLS spoofing in HCL NotesVendor2026-10-27 17:16 UTCby EPSS–WHAT TO DO CRITICAL9.1HCL Domino: compromised eMudhra CA keys let attackers spoof TLS serversVendor2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH8.5Administrator MFA bypass by disabling MFA globally before verificationVeeam ONEOther2026-10-27 17:16 UTCby InfraStack Analyst–FIX 13.1.0.7940 (13.1 P1)MEDIUM6.9Veeam Backup for Microsoft 365: forged federation token bypasses REST API authenticationOther2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH8.3Veeam Backup for Microsoft 365: admin role reads arbitrary files as LocalSystemVeeam Backup for Microsoft 365Vendor2026-10-27 17:16 UTCby InfraStack Analyst–FIX 8.6.0.1102 CRITICAL9.0Veeam Backup for Microsoft 365: SQL injection leads to remote code executionVeeam Backup for Microsoft 365Vendor2026-10-27 17:16 UTCby InfraStack Analyst–FIX 8.6.0.1102 CRITICAL10.0Adobe Campaign Classic: SQL injection lets attackers run arbitrary commandsAdobe Campaign ClassicVendor2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9Adobe Campaign Classic: authorization flaw lets low-privileged users run codeAdobe Campaign ClassicVendor2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Adobe Campaign Classic: SQL injection lets low-privileged users read and write dataAdobe Campaign ClassicVendor2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9Adobe Campaign Classic: SQL injection lets low-privileged users run codeAdobe Campaign ClassicVendor2026-10-27 17:16 UTCby InfraStack Analyst–FIX 7.4.4 build 9403 HIGH7.3Veeam Agent for Linux: local privilege escalation to root on managed hostsInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO CRITICAL9.1Adobe Campaign Classic: SQL injection lets high-privilege users run codeVendor2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9Adobe Campaign Classic: OS command injection lets low-privilege users run codeAdobe Campaign ClassicVendor2026-10-27 17:16 UTCby InfraStack Analyst–FIX 7.4.4 build 9403 CRITICAL9.9Adobe Campaign Classic: code injection lets a low-privileged user run codeAdobe Campaign ClassicOther2026-10-27 17:16 UTCby InfraStack Analyst–FIX 7.4.4 build 9403 (unconfirmed)CRITICAL9.3Adobe Campaign Classic: reflected XSS lets attacker run scripts in victims' sessionsVendor2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.3Adobe Creative Cloud Desktop: search path flaw runs code as the userOther2026-10-27 17:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Autodesk Fusion: crafted library file's HTML description enables stored XSSOther2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.1Autodesk Fusion: crafted Fusion URL in documentName runs script locallyPackage2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.1Autodesk Fusion: HTML in a design name runs script and reads local filesOther2026-10-27 17:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Veeam Backup for Microsoft 365: local users can write files as SYSTEMInfrastructure2026-10-27 17:16 UTCby EPSS–WHAT TO DO HIGH7.8Hydra legacy target blacklist permits unsafe PyYAML loadinghydra-corePackage2026-10-27 17:08 UTCby GitHub Advisories–FIX 1.3.8 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @webapp-shared/login-vmok (npm)@webapp-shared/login-vmokPackage2026-10-27 17:08 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in numprint (PyPI)numprintPackage2026-10-27 16:48 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Voice Call Failures from Twilio Mobile Numbers to IsraelTwilioVendor2026-10-27 16:41 UTCby status page–WHAT TO DO LOWINCIDENTCloudflare: Issues with AI Security for AppsCloudflareVendor2026-10-27 16:31 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @testsecuiitytestme/cache-helper (npm)@testsecuiitytestme/cache-helperPackage2026-10-29 13:12 UTCby osv-malicious–UNINSTALL MEDIUMCAMPAIGNDATA EXPOSEDWarp (AI terminal / agentic dev environment) breached through a third-party vendor: agent logs and telemetry of about 1% of users exposedWarpAI agents & MCP2026-10-27by InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in adyen-web-v6 (npm)adyen-web-v6Package2026-10-27 16:23 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in buttoncontent (npm)buttoncontentPackage2026-10-27 16:17 UTCby osv-malicious–UNINSTALL CRITICAL9.2WatchGuard Fireware OS: WebSocket integer overflow lets unauthenticated attackers write heap memoryInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.2WatchGuard Fireware OS: FireCluster daemon lets unauthenticated remote admin actionsInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.1WatchGuard Fireware OS: local link following lets a low-privileged process overwrite root filesFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH7.2FireCluster Sync: out-of-bounds read lets cluster peer crash firewallFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 CRITICAL9.2Fireware OS: SIP proxy buffer overflow lets unauthenticated remote attackers run codeInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH8.7WatchGuard Fireware OS: XPath injection in SSH login leaks configuration dataInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.8TeamViewer for Windows: local low-privilege user gains SYSTEM code executionPackage2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.8TeamViewer Remote Management: IPC flaw lets local user gain SYSTEMOther2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.8TeamViewer: local low-privilege user can run scripts as SYSTEMOther2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.8TeamViewer macOS helper race lets local users install root-level packagesRuntime2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH8.8TeamViewer Full Client: screen decoder flaw lets crafted image run codeOther2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH9.4FireCluster Sync: missing authentication lets cluster-link attacker run firewall management as rootFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH7.2WatchGuard Fireware OS: authenticated CLI command lets attacker write root-level filesFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH8.6WatchGuard Fireware OS: certd buffer overflow lets an authenticated user crash or run codeInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.7WatchGuard Fireware OS: AuthPoint MFA flaw lets attacker hijack pending loginInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.5node-tesseract: image argument lets remote attackers inject OS commandsPackage2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.5Dexbotic: path traversal in GR00T checkpoint loader lets attackers read filesdexboticAI agents & MCP2026-10-27 16:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Rasa NLU Chi: model persistor path traversal lets remote attackers reach filesAI agents & MCP2026-10-27 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.6Newsletters Lite WordPress plugin: CSRF flaw lets attackers act as adminsPackage2026-10-27 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.7WatchGuard Mobile VPN Windows client leaks VPN credentials over loopbackInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.1WatchGuard Fireware OS: stack overflow in VPN access check lets authenticated users run codeInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.2WatchGuard Fireware OS: crafted Active Directory reply can crash or run codeInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.2WatchGuard Fireware OS: heap overflow in auth service lets crafted AD response run codeFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH8.8PUBLIC EXPLOITTeamViewer clients: integer overflow in screen processing lets remote host run code5 talkingPackage2026-10-27 16:17 UTCby EPSS5talkingWHAT TO DO HIGH7.3TeamViewer Patch Management for Windows: installer race lets low-privilege users run code as adminOther2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.3TeamViewer Windows installer lets local low-privilege users run commands as SYSTEMOther2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.3TeamViewer Remote Management installer: DLL loading lets local users gain elevated privilegesVendor2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH8.7WatchGuard Fireware OS: crafted login request crashes management interfaceInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO LOW2.3Tidewave: local dev server leaks project filesystem paths via DNS rebindingPackage2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH8.8Autodesk Fusion: crafted .stack.json file runs commands as current userOther2026-10-27 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDRejected CVE-2026-107458: upstream withdrew it, no exploit demonstratedOther2026-10-27 16:17 UTCby NVD–WHAT TO DO MEDIUM6.0WatchGuard Fireware OS: unauthenticated cluster sync traffic can drop VPN tunnelsInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO HIGH7.5Nextcloud 3D Viewer: password-protected shares readable by token alonePackage2026-07-27 11:32 UTCby EPSS–WHAT TO DO CRITICAL9.5WatchGuard Fireware OS: WireGuard config overflow lets attackers run codeFireware OSInfrastructure2026-10-27 16:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH7.1WatchGuard Fireware OS: logging service overflow lets rogue log server run codeInfrastructure2026-10-27 16:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCloudflare: Cloudflare Stream performance issues impacting certain Live Broadcasts and On-Demand UploadsCloudflareVendor2026-10-27 16:10 UTCby status page–WHAT TO DO LOW2.3rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alertrustlsPackage2026-10-27 16:08 UTCby GitHub Advisories–FIX 0.23.46 LOW3.7rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 sharerustlsPackage2026-10-27 16:08 UTCby GitHub Advisories–FIX 0.23.46 MEDIUM4.0Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsrustlsPackage2026-10-27 16:08 UTCby GitHub Advisories–FIX 0.23.46 LOW3.7Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.rustlsPackage2026-10-27 16:08 UTCby GitHub Advisories–FIX 0.23.46 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in fetch-hash-cache-atomic (npm)fetch-hash-cache-atomicPackage2026-10-27 15:49 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in string-target-mapper-hash (npm)string-target-mapper-hashPackage2026-10-27 15:49 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in macro-kernel-record-reader (npm)macro-kernel-record-readerPackage2026-10-27 15:49 UTCby osv-malicious–UNINSTALL HIGH7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storagestrands-agentsAI agents & MCP2026-10-27 15:34 UTCby GitHub Advisories–FIX 1.48.0 MEDIUMNOT SCOREDStrands Agents: Default FileSessionManager storage is world-readable on shared systemsstrands-agentsAI agents & MCP2026-10-27 15:34 UTCby GitHub Advisories–FIX 1.48.0 HIGH8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`litellmAI agents & MCP2026-10-27 15:32 UTCby GitHub Advisories–FIX 1.95.0 LOW3.7@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL@better-auth/drizzle-adapterPackage2026-10-27 15:32 UTCby GitHub Advisories–FIX 1.7.7 HIGH7.4better-auth: OAuth Proxy lets an attacker sign in as another userbetter-authPackage2026-10-27 15:32 UTCby GitHub Advisories–FIX 1.7.7 MEDIUM6.8LiteLLM vulnerable to reflected XSS in /sso/debug/callbacklitellmAI agents & MCP2026-10-27 15:31 UTCby GitHub Advisories–FIX 1.85.0 HIGHNOT SCOREDGitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)GitPythonPackage2026-10-27 15:28 UTCby GitHub Advisories–FIX 3.2.0 MEDIUMNOT SCOREDGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktreeGitPythonPackage2026-10-27 15:26 UTCby GitHub Advisories–FIX 3.2.0 HIGH8.1GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command executionGitPythonPackage2026-10-27 15:26 UTCby GitHub Advisories–FIX 3.2.0 HIGH7.5GitPython command wrappers omit unsafe protocol and option checksGitPythonPackage2026-10-27 15:26 UTCby GitHub Advisories–FIX 3.2.0 MEDIUM6.5GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule nameGitPythonPackage2026-10-27 15:26 UTCby GitHub Advisories–FIX 3.2.0 HIGHNOT SCOREDGitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity linesGitPythonPackage2026-10-27 15:26 UTCby GitHub Advisories–FIX 3.2.0 NOT SCOREDNOT SCOREDAidot smart plugs and bulbs: UPnP parsing flaw allows remote code executionInfrastructure2026-10-27 15:17 UTCby EPSS–WHAT TO DO HIGH8.7Grav CMS: debugger flaw lets anonymous visitors read admin passwordsRuntime2026-10-27 03:16 UTCby EPSS–WHAT TO DO MEDIUM5.5a2a-java: race condition in TaskManager.saveTaskEvent up to 1.2.0.FinalPackage2026-10-27 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3a2a-java: push notification config store lets remote requests exhaust resourcesPackage2026-10-27 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.3a2a-java: queue offer flaw lets remote callers exhaust resourcesPackage2026-10-27 15:16 UTCby EPSS–WHAT TO DO MEDIUM5.1KGS tia Viewer: stored XSS via annotation API runs script in browsersOther2026-10-27 15:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: Gateway API (Lookup API) Failure Increase on Three in United KingdomTwilioVendor2026-10-27 15:15 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Cache Purging Delays in EEUR mainly ARNCloudflareVendor2026-10-27 15:10 UTCby status page–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors for Claude Sonnet 5.5AnthropicVendor2026-10-27 15:09 UTCby status page–WHAT TO DO MEDIUMTECHNIQUEGLPI Agent remote code execution via rogue GLPI server using an AD CS ESC17 certificate (public tool GLPwnIou)GLPI AgentInfrastructure2026-10-20 15:06 UTCby InfraStack Analyst–WHAT TO DO MEDIUMTECHNIQUESVG sanitizer bypasses: six of eight popular SVG sanitizer libraries let uploaded SVGs run JavaScript (XSS)sanitize-svg2 talkingPackage2026-10-27 14:29 UTCby InfraStack Analyst2talkingWHAT TO DO MEDIUM5.9Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of servicenodemailerPackage2026-10-27 15:04 UTCby GitHub Advisories–FIX 10.0.13 MEDIUM5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippednodemailerPackage2026-10-27 15:04 UTCby GitHub Advisories–FIX 10.0.13 MEDIUM5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of servicenodemailerPackage2026-10-27 15:04 UTCby GitHub Advisories–FIX 10.0.10 MEDIUMINCIDENTOpenAI: 6.1 Sol Degraded Model PerformanceOpenAIVendor2026-10-27 15:02 UTCby status page–WHAT TO DO HIGH8.6NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containmentnltkPackage2026-10-27 14:50 UTCby GitHub Advisories–FIX 3.10.4 HIGH8.1better-auth: Device login approval does not show the requesting client or permissionsbetter-authPackage2026-10-27 14:49 UTCby GitHub Advisories–FIX 1.7.0-rc.3 HIGH7.2Dell PowerProtect Data Domain Virtual Edition: privileged user can bypass protection mechanismsVendor2026-10-27 14:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain Virtual Edition: path traversal allows command executionVendor2026-10-27 14:17 UTCby EPSS–WHAT TO DO LOW3.8Dell PowerProtect Data Domain: relative path traversal allows information tamperingInfrastructure2026-10-27 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.0Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of serviceInfrastructure2026-10-27 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.9Dell PowerProtect Data Domain: stack buffer overflow allows denial of serviceInfrastructure2026-10-27 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Dell PowerProtect Data Domain: path traversal in certificate handling enables denial of serviceInfrastructure2026-10-27 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.3EdoWEB: authorization bypass lets users reach restricted functionalityOther2026-10-27 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.1Octopus Server: crafted NuGet package lets a deploy script escape its directoryPackage2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Layout frame poisoning flaw, fixed in ESR 115.44Other2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in JavaScript garbage collector fixed in 159Runtime2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox SVG component flaw fixed in Firefox 159Other2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Graphics Text component, fixed in 159Other2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in WebRender lets content escape the sandboxOther2026-10-27 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Disability Access APIs escapes sandboxRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XPCOM lets web content escape the sandboxRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component can be exploitedOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM File component allows memory corruptionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox for Android: Downloads component spoofing issue fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in SVG component could crash or run codeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript JIT use-after-free can be triggered by crafted scriptRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in image, video and HTML frame layoutRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM Animation component fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS parsing flaw lets a page corrupt frame memoryRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Disability Access APIs component fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: integer overflow and use-after-free in Graphics Text componentOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM Navigation flaw allows privilege escalation, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in JavaScript garbage collector fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in WebRTC signaling enables privilege escalationRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in WebRTC signaling lets attacker run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS animation boundary flaw fixed in Firefox 159 and ESR 153.6Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DNS networking flaw leaks information to attackersOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: race condition in Networking component leaks informationOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: HTTP networking flaw can leak information to attackersRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: race condition in IPC component may allow unspecified exploitationRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: mitigation bypass in DOM Push Subscriptions componentRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Widget lets a sandbox escapeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: WebRTC boundary-condition flaw fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM UI Events and Focus Handling flaw allows privilege escalationRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript garbage collector use-after-free fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: integer overflow in Graphics Text component, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS parsing flaw leaks information, fixed in Firefox 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: boundary error in Layout text and fonts code, fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox WebRender: boundary check flaw allows sandbox escapeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Graphics component may let attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDFirefox: boundary error in WebGL canvas lets web content escape sandboxRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Graphics use-after-free fixed in Firefox 159 and ESR 153.6Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Graphics component may allow code executionOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDFirefox: use-after-free in Graphics lets web content escape the sandboxPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary handling in scrolling and overflow layoutRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Graphics component may allow code executionOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript JIT invalid pointer flaw may allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Toolkit flaw lets attackers escalate privileges, fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Graphics component may allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: WebRender boundary check flaw fixed in recent releasesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Graphics boundary error fixed in releases 159 and ESR 153.6Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Console component flaw fixed in Firefox 159 and ESR 153.6Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM navigation flaw breaks site isolation, fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in WebRender lets content escape the sandboxRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in the XML component fixed in recent releasesOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DNS networking lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Graphics component use-after-free fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Print Preview lets a page escape the sandboxPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: race condition in Disability Access APIs component fixedRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript JIT invalid pointer may allow memory corruptionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM security component mitigation bypass, fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: site isolation flaw in HTTP networking component fixedOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Address Bar flaw bypasses same-origin policy, fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Panning and Zooming component, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: service worker boundary bug fixed in versions 159 and ESR 153.6Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Quota Manager boundary flaw lets web content escape sandboxRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary checks in text and font layout codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM spoofing flaw in Core and HTML component, fixedOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Service Workers site isolation flaw fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: site isolation flaw in HTTP networking fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: WebRTC networking cryptographic flaw fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in Nimbus Desktop Client component fixedOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JIT miscompilation in WebAssembly component may allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout Positioned component fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM use-after-free bug fixed in Firefox 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: uninitialized memory in Networking component fixed in releasesOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets code runRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM boundary-condition flaw fixed in Firefox 159 and ESRRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets attacker run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in SVG component can crash or run codeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XML component may let attackers run codeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript engine boundary check flaw, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: XML component boundary bug fixed in versions 159 and ESR 153.6Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component may allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets page content corrupt memoryPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript JIT boundary bug could let web content run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in CSS Object Model can be exploitedRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM Core and HTML componentOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XML component fixed in version 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component can crash or corrupt memoryRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in JavaScript engine fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM bindings lets pages run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component can be exploitedOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS parsing flaw enables frame poisoning, fixed in 159Package2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM Events lets a page run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM bindings can crash or run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS parsing flaw lets pages bypass same-origin policyRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in SVG component may allow memory corruptionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary checks in SVG component, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets a page run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XSLT component fixed in several releasesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Audio/Video component can be triggered by page contentRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in WebSockets networking lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in CSS parsing lets attacker run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in HTML parser can crash or run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Canvas2D graphics component fixed in releasesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in WebRender graphics can crash or be exploitedPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XSLT component could let a page run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: layout engine boundary bug fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in the SVG component, fixed in releasesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in SVG component may allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: CSS parsing flaw lets pages bypass the same-origin policyRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in audio and video playback componentRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in JavaScript engine may allow memory corruptionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript garbage collector use-after-free fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in image library lets attacker run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Networking component fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in CSS parsing lets attacker-controlled pages crash or run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in audio and video playback componentRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript garbage collector use-after-free fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Audio/Video component fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout Text and Fonts componentOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets page content crash or run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM Editor component, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in HTTP networking can be triggered by crafted contentRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JIT engine use-after-free flaw fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary handling in table layout code, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets attacker run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: WebRTC signaling boundary error fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: boundary check flaw in the PSM security componentOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: WebRTC networking use-after-free lets attackers escalate privilegesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript JIT use-after-free could let a web page run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox JavaScript engine: JIT miscompilation may let a web page run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript engine boundary bug fixed in Firefox 159 and ESRRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: uninitialized memory in Canvas2D can expose dataRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary checks in Graphics Text component fixedRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Grid layout code fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Networking component could allow code executionRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in HTML parser can crash or run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component may allow code executionOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core lets a page run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in XML component may let attackers run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: incorrect boundary handling in Layout Tables component, fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in IndexedDB storage fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in text layout lets attacker run codeOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDFirefox: use-after-free in text layout and fonts codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in scrolling and overflow layout codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Internationalization component fixed in 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: boundary check flaw in audio and video playbackRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in JavaScript standard library can be exploitedRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: invalid pointer in Graphics component may allow memory corruptionOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in JavaScript engine fixed in version 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in DOM core and HTML lets a page run codePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: sandbox escape in the DOM networking component, fixed in 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Layout component can crash or run codeRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: use-after-free in Canvas2D lets a page escalate privilegesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: JavaScript garbage collector use-after-free fixed in Firefox 159Runtime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: Form Manager sandbox escape fixed in Firefox 159Other2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: uninitialized memory in Audio/Video leaks data to attackersRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: networking boundary bug lets an attacker escalate privilegesRuntime2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: DOM navigation flaw lets web content escape the sandbox1 talkingRuntime2026-10-27 14:16 UTCby EPSS1talkingWHAT TO DO NOT SCOREDNOT SCOREDFirefox: Navigation component lets pages bypass same-origin policy1 talkingOther2026-10-27 14:16 UTCby EPSS1talkingWHAT TO DO CRITICAL9.3Electrum: Nostr Wallet Connect plugin lets clients exceed spending limitsPackage2026-04-28 17:09 UTCby EPSS–WHAT TO DO HIGH8.6Electrum: external plugin loader runs unsigned plugin code without authorization checkPackage2026-04-28 17:09 UTCby EPSS–WHAT TO DO CRITICAL9.3Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itelectrumPackage2026-10-24 12:52 UTCby EPSS–FIX 4.8.3 HIGH8.5hagent: MCP tool args allow shell command injection on the serverAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.2nmap-mcp: allowlist bypass lets MCP callers run intrusive Nmap scriptsAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5Kali-GPT: MCP server lets shell metacharacters in scanner parameters run commandsAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH7.3mcp-ffmpeg: crafted file paths let attackers run shell commandsAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5esp-mcp: shell metacharacters in MCP tool parameters run arbitrary commandsesp-mcpAI agents & MCP2026-10-27 14:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9EasyImages 2.0: unauthenticated path traversal reads server files outside upload directoryPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9Artalk: anonymous comments make the server fetch internal URLsPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO CRITICAL9.8nest-admin: hardcoded JWT secret lets attackers forge admin tokensPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.4MrDoc: authenticated users can alter other users' document share settingsPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9rssant: anonymous endpoint leaks stories from unpublished feedsPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5sf-mcp: crafted Salesforce CLI flag values run shell commands as MCP userAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5ATXP Gemini CLI extension: shell command injection through MCP tool parametersAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5DroidMind: MCP clients bypass shell allowlist via command substitutionAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5ai-sdlc MCP server: shell metacharacters in repo argument run commandsAI agents & MCP2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9SDL_image: crafted ILBM file reads past stack array in HAM modePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.3zchunk: crafted .zck file triggers heap out-of-bounds read and crashPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9CImg: crafted BMP file triggers heap out-of-bounds read in image loaderPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Admidio: members can fill event seats by submitting guest fieldPackage2026-10-26 19:52 UTCby EPSS–WHAT TO DO HIGH7.7Umbraco CMS: Host header poisoning lets attackers hijack back-office sessionsRuntime2026-10-27 06:20 UTCby EPSS–WHAT TO DO MEDIUM6.9a2a-go: task cancel flaw in distributed manager allows remote denial of servicePackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9a2a-go: REST SSE handler lets remote callers exhaust server resourcesPackage2026-10-27 14:16 UTCby EPSS–WHAT TO DO MEDIUM6.9BMC Control-M: misconfiguration lets unauthenticated remote users reach servicesVendor2026-10-27 14:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDSuperDuper! backup app leaks sensitive information to local usersOther2026-10-27 14:16 UTCby EPSS–WHAT TO DO HIGH8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowoauthlibPackage2026-10-27 13:30 UTCby GitHub Advisories–FIX 4.0.0 CRITICAL9.3MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)monaiPackage2026-10-27 13:30 UTCby GitHub Advisories–FIX 1.6.1 LOWNOT SCOREDdcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSdcmjsPackage2026-10-27 13:29 UTCby GitHub Advisories–FIX 0.52.0 HIGHNOT SCOREDWails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginsgithub.com/wailsapp/wails/v2Package2026-10-27 13:29 UTCby GitHub Advisories–FIX 2.13.0 HIGH8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameterdolibarr/dolibarrPackage2026-10-27 13:29 UTCby GitHub Advisories–WHAT TO DO HIGH7.5Keepnet Agentic Ally: authentication bypass by spoofing before commit 0ef61f2eAI agents & MCP2026-10-27 13:17 UTCby EPSS–WHAT TO DO HIGH8.4NVIDIA NeMo Agent Toolkit: SQL injection enables data tampering and disclosureAI agents & MCP2026-10-27 13:16 UTCby EPSS–WHAT TO DO CRITICAL10.0NVIDIA NeMo Agent Toolkit: missing authentication lets attackers run codeAI agents & MCP2026-10-27 13:16 UTCby EPSS–WHAT TO DO HIGH7.1NVIDIA TensorRT-LLM: server-side request forgery lets attackers reach internal servicesAI agents & MCP2026-10-27 13:16 UTCby EPSS–WHAT TO DO HIGH8.4NVIDIA TensorRT-LLM: KvCacheAwareRouter tokenizer loading can run attacker codeAI agents & MCP2026-10-27 13:16 UTCby EPSS–WHAT TO DO HIGH7.8NVIDIA PhysX: out-of-bounds write lets an attacker run codeRuntime2026-10-27 13:16 UTCby EPSS–WHAT TO DO HIGH7.1NVIDIA TensorRT-LLM: server-side request forgery leads to data disclosure and tamperingAI agents & MCP2026-10-27 13:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Ontime: missing brute-force limit on login lets attackers guess passwordsPackage2026-10-27 13:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPowerShell Universal: notification target URL lets users run browser scriptsPackage2026-10-27 13:16 UTCby EPSS–WHAT TO DO MEDIUM5.7Docker Desktop: API keys and OAuth tokens written to local logs in cleartextRuntime2026-10-27 13:16 UTCby EPSS–WHAT TO DO LOW1.9Qt 5: encoding text with QTextCodec can write outside a bufferPackage2026-10-27 13:16 UTCby EPSS–WHAT TO DO HIGH7.5Rolantis Agentis: observable response lets attackers detect valid accountsOther2026-10-27 13:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Receipt Delays from a Subset of Twilio Long Codes to AT&T United StatesTwilioVendor2026-10-27 12:58 UTCby status page–WHAT TO DO HIGHINCIDENTCloudflare: ERR_TIMED_OUT and ERR_EMPTY_RESPONSE being observed by Cloudflare CustomersCloudflareVendor2026-10-27 12:28 UTCby status page–WHAT TO DO MEDIUMCAMPAIGNDATA EXPOSEDKeystone hardware wallet device-verification key stolen in website breach: counterfeit wallets could pass the authenticity checkKeystone hardware walletVendor2026-10-27by InfraStack Analyst–WHAT TO DO MEDIUM4.9Dell PowerProtect Data Domain: stack buffer overflow lets a privileged user crash serviceInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM4.9Dell PowerProtect Data Domain: stack overflow lets privileged remote user crash serviceInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Dell PowerProtect Data Domain: improper access control allows remote denial of serviceInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM6.7Dell PowerProtect Data Domain: privilege management flaw lets admins escalate rightsInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Dell PowerProtect Data Domain: local high-privilege user can escalate privilegesVendor2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM5.8Dell PowerProtect Data Domain: unauthenticated server-side request forgery flawInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH8.8PuMuKIT: unauthenticated file upload to any path enables server takeoverpumukitPackage2026-10-27 12:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.9Eaton easySoft accepts unverified TLS certificates from easyE4 devicesInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH7.5Eaton easyE4: weak password policy lets captured hashes be crackedInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH7.5Eaton easyE4: static authentication nonce lets captured logins be replayedeasyE4 base unit firmwareInfrastructure2026-10-27 12:17 UTCby InfraStack Analyst–FIX 2.46 HIGH7.7CoreTec device: time-zone setting lets authenticated users run OS commandsInfrastructure2026-10-27 12:17 UTCby EPSS–WHAT TO DO LOW3.7@fastify/session: in-flight request can revive a logged-out sessionPackage2026-10-27 10:47 UTCby EPSS–WHAT TO DO MEDIUM5.5crypto11 Go library: ML-KEM key lookup can return the wrong public keyPackage2026-10-22 16:38 UTCby EPSS–WHAT TO DO CRITICAL9.1Eclipse ioFog Operator: disabled TLS verification lets on-path attackers steal credentialsPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Eclipse ioFog iofogctl: API response values run as shell commandsPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO CRITICAL9.1@fastify/express: absolute-form URLs can skip Express auth middleware on scoped routesPackage2026-10-27 08:44 UTCby EPSS–WHAT TO DO HIGH7.7TRO600 router: authenticated users can reach localhost-only services via port forwardingTRO600 Series FirmwareInfrastructure2026-10-27 12:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.8WordPress ACF Extended plugin lets anonymous visitors delete media attachmentsPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Advanced Views plugin: unauthenticated stored XSS through comment parameterPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH8.7TRO600 router: unauthenticated arbitrary file read exposes configs and passwordsTRO600Infrastructure2026-10-27 12:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1Kulga News Software: reflected XSS lets attackers run scripts in visitors' browsersPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO HIGH8.7Joomla DJ-HelpfulArticles: unauthenticated stored XSS via vote widget IP fieldPackage2026-10-27 12:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio to Turkcell TurkeyTwilioVendor2026-10-27 11:39 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: We are seeing some customers having issues with Workers BuildsCloudflareVendor2026-10-27 11:38 UTCby status page–WHAT TO DO MEDIUM6.9svg-sanitizer: uncaught exception lets crafted SVG crash upload workersPackage2026-10-19 12:09 UTCby EPSS–WHAT TO DO HIGH8.7svg-sanitizer: crafted SVG upload exhausts CPU in sanitize()Package2026-10-19 12:09 UTCby EPSS–WHAT TO DO MEDIUM5.1svg-sanitizer: crafted SVG files can embed remote resources and leak dataPackage2026-09-01 09:41 UTCby EPSS–WHAT TO DO MEDIUM4.1REDAXO: reflected XSS in backend packages API lets lured admins run scriptsPackage2026-04-09 14:36 UTCby EPSS–WHAT TO DO MEDIUM4.1REDAXO: reflected XSS in metainfo API runs scripts in admin sessionsRuntime2026-04-09 14:36 UTCby EPSS–WHAT TO DO HIGH8.8REDAXO: backend user page lets a crafted link change account rightsOther2026-07-31 15:44 UTCby EPSS–WHAT TO DO MEDIUM6.1REDAXO: backend media pool page reflects opener_link, enabling cross-site scriptingRuntime2026-07-31 15:25 UTCby EPSS–WHAT TO DO MEDIUM5.4REDAXO CMS: history plugin lets a link delete snapshots or roll back articlesRuntime2026-07-31 15:50 UTCby EPSS–WHAT TO DO MEDIUM4.4REDAXO: stored XSS via uploaded SVG files in media poolPackage2026-08-03 13:59 UTCby EPSS–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITREDAXO CMS: structure/history plugin flaw lets attackers forge login tokensRuntime2026-08-03 14:00 UTCby EPSS–WHAT TO DO MEDIUM6.7JetBrains Junie CLI: incomplete allowlist check lets commands executeAI agents & MCP2026-10-27 11:17 UTCby EPSS–WHAT TO DO HIGH8.6Octopus Server: System Manager role can escalate to full AdministratorOther2026-10-27 11:17 UTCby EPSS–WHAT TO DO HIGH7.7Octopus Server: user invitation codes written to the audit logOctopus ServerOther2026-10-27 11:17 UTCby InfraStack Analyst–FIX 2026.2.13438 MEDIUM5.4REDAXO CMS: stored XSS in media and link widgets hijacks admin sessionsPackage2026-08-03 13:58 UTCby EPSS–WHAT TO DO HIGH7.1REDAXO CMS: authenticated editors can alter slices in other categoriesRuntime2026-08-03 13:57 UTCby EPSS–WHAT TO DO HIGH7.1REDAXO: media pool bulk move skips source category permission checkOther2026-08-03 13:57 UTCby EPSS–WHAT TO DO HIGH7.1REDAXO CMS: preview modes let backend users read unpublished contentPackage2026-08-03 13:56 UTCby EPSS–WHAT TO DO HIGH7.7REDAXO: backup addon exports any table, exposing admin sessions and password hashesPackage2026-10-06 15:10 UTCby EPSS–WHAT TO DO MEDIUM5.4REDAXO: backend accepts forged safemode link, disabling safe mode via CSRFPackage2026-10-06 15:11 UTCby EPSS–WHAT TO DO MEDIUM4.2REDAXO CMS: old sessions survive password change for up to three monthsRuntime2026-10-06 15:11 UTCby EPSS–WHAT TO DO MEDIUM6.8REDAXO: missing authorization lets backend users manage packages and drop tablesPackage2026-10-06 15:11 UTCby EPSS–WHAT TO DO MEDIUM6.1Semantic MediaWiki: reflected XSS in Special:Search lets attackers run scriptPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.1SemanticMediaWiki: reflected XSS in FacetedSearch via cstate parameterPackage2026-08-19 01:35 UTCby EPSS–WHAT TO DO HIGH7.3Semantic MediaWiki: unauthenticated users can run admin maintenance tasks via APIPackage2026-09-16 02:32 UTCby EPSS–WHAT TO DO MEDIUM6.1SemanticMediaWiki: stored XSS via Code-typed property values on Special:BrowsePackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM4.8SemanticMediaWiki: stored XSS via unescaped property group namePackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM5.4Semantic MediaWiki: stored XSS via Keyword properties on Special:BrowsePackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM5.4Semantic MediaWiki: stored XSS via External identifier values runs scriptsPackage2026-09-28 18:41 UTCby EPSS–WHAT TO DO MEDIUM6.1Semantic MediaWiki: reflected XSS in Special:SMWAdmin ID lookupPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.1SemanticMediaWiki: stored XSS via tooltip data attributes runs script on hoverPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM4.8Semantic MediaWiki: schema descriptions allow stored cross-site scripting by editorsPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM4.8Semantic MediaWiki: stored XSS via FacetedSearch exploration-link labelsPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.1Semantic MediaWiki: stored XSS in property autocomplete dropdownPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH7.1Semantic MediaWiki: CSRF in SMWAdmin lets lured admins wipe semantic dataPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.9Semantic MediaWiki: users with edit rights can force updates on restricted pagesPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH8.7Semantic MediaWiki: anonymous requests can exhaust server CPU, memory, and database connectionsPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH8.7Semantic MediaWiki: recurring-event limit bypass lets editors exhaust server resourcesPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH7.1Semantic MediaWiki: ordinary editors can lock pages permanently via annotationPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.1SemanticMediaWiki: Special:Ask reflects separator parameters, enabling cross-site scriptingPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO MEDIUM6.1SemanticMediaWiki: reflected XSS in Special:Ask lets attackers run scriptsPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH7.3Semantic MediaWiki: smwtask API lets anonymous users run jobs and updatesPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH8.7Semantic MediaWiki: crafted search terms exhaust CPU via quadratic parsingPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH8.7Semantic MediaWiki: unauthenticated nested queries exhaust CPU and memoryPackage2026-09-28 18:42 UTCby EPSS–WHAT TO DO HIGH8.7Octopus Server: inconsistent OIDC issuer checks let forged tokens authenticateOctopus ServerPackage2026-10-27 11:17 UTCby InfraStack Analyst–FIX 2026.1.11781 MEDIUM5.3Moxa wireless device servers: web interface overflow lets attackers crash management serviceInfrastructure2026-10-27 11:17 UTCby EPSS–WHAT TO DO LOW2.3Vaadin: push endpoint reflects any Origin with credentials allowedPackage2026-10-27 11:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @azure-growth/signup-ux-components (npm)@azure-growth/signup-ux-componentsPackage2026-10-27 11:00 UTCby osv-malicious–UNINSTALL CRITICAL9.4JP1 products: out-of-bounds write flaw in multiple management toolsInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 products: heap buffer overflow in Hitachi job management suiteInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4Hitachi JP1 job management: stack buffer overflow in several productsInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8JP1/Base: heap buffer overflow may let an attacker run codeOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO HIGH8.3Google Compute Engine: disk snapshot API lets attackers copy cross-project disk dataVendor2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4HiRDB database server: stack buffer overflow may allow code executionRuntime2026-10-27 10:16 UTCby EPSS–WHAT TO DO HIGH7.5HiRDB: origin validation flaw in database server versions 9 and 10Other2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8HiRDB: heap buffer overflow in server lets attackers run codePackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8HiRDB database server: OS command injection lets attackers run system commandsOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8HiRDB database server: stack buffer overflow allows remote code executionOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8HiRDB: authentication bypass by spoofing lets attackers get inRuntime2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8HiRDB database server: missing authentication on a critical functionRuntime2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8JP1 Automatic Job Management System 3: heap overflow may allow code executionOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8JP1 Automatic Job Management System 3: authentication bypass lets attackers inInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 Automatic Job Management System 3: heap overflow in ManagerOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 Automatic Job Management System 3: stack buffer overflow in ManagerInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 Automatic Job Management System 3: stack buffer overflow enables code executionOther2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8JP1 Automatic Job Management System 3: stack buffer overflow in Manager and AgentInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 Automatic Job Management System 3: heap overflow in Manager and AgentInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.4JP1 Automatic Job Management System 3: stack buffer overflow in Manager and AgentInfrastructure2026-10-27 10:16 UTCby EPSS–WHAT TO DO HIGH8.3AI sessions API: SVG uploads run injected script in the assistant windowCloud BI PlatformAI agents & MCP2026-10-27 10:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.3BloX widgets: stored XSS via dashboard widget desc and text fieldsCloud BI PlatformPackage2026-10-27 10:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Roundcube 2FA plugin: spoofed client headers let attackers skip second factorPackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.3Roundcube 2FA plugin: failed verification leaves session alive for attackerPackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO MEDIUM6.3Roundcube 2FA plugin lacks rate limiting, allowing second-factor brute forcePackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.3Joomla Gridbox extension: missing authorization check exposes blog post dataPackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.3Joomla Gridbox extension: unauthenticated SQL injection via store sort parameterPackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Phoca Download for Joomla: CSRF in category management lets attackers change categoriesPackage2026-10-27 10:16 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress Qode Membership plugin: unauthenticated login as any user, including adminsPackage2026-10-27 09:16 UTCby EPSS–WHAT TO DO MEDIUM6.6BMC firmware: IPMI administrator can run commands as rootInfrastructure2026-10-27 09:16 UTCby EPSS–WHAT TO DO HIGH7.2BMC firmware: IPMI administrator can write physical memory and run codeInfrastructure2026-10-27 09:16 UTCby EPSS–WHAT TO DO HIGHINCIDENTAnthropic: Elevated errors for Claude Sonnet 5.5AnthropicVendor2026-10-27 09:14 UTCby status page–WHAT TO DO CRITICALCAMPAIGNDATA EXPOSEDGMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortionOnamae.com Desktop Cloud3 talkingVendor2026-10-27 01:30 UTCby InfraStack Analyst3talkingWHAT TO DO MEDIUMTECHNIQUEUnpatched Godot 4 flaw lets a community .po translation file run attacker-chosen code inside exported gamesGodot EngineRuntime2026-10-26 20:37 UTCby InfraStack Analyst–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures From Twilio Phone Numbers to GermanyTwilioVendor2026-10-27 09:00 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures From a Subset of Twilio Phone Numbers to Multiple Networks in GermanyTwilioVendor2026-10-27 08:37 UTCby status page–WHAT TO DO HIGH8.8BMC IPMI: crafted RAKP+ messages can escalate an account to administratorInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGH7.4BMC RAKP+ flaw lets attackers open sessions and run commandsSupermicro BMC firmware (ATEN)Infrastructure2026-10-27 08:16 UTCby InfraStack Analyst–FIX X11DPT-PS 01.74.26 MEDIUM4.9BMC firmware: authenticated IPMI administrator can read arbitrary filesInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO LOW3.1KVM-over-IP HTML5 console: weak session token lets attacker take over sessionInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO CRITICAL9.8BMC: IPMI commands run without integrity or encryption checksInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGH7.5BMC: IPMI commands run without integrity or encryption checksSupermicro BMC firmware (X10-X14, H13, H14, X11, X12)Infrastructure2026-10-27 08:16 UTCby InfraStack Analyst–FIX per board, see advisory HIGH7.2BMC firmware: insufficient input filtering lets injected OS commands runInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGH7.5OnCell G3150A-LTE: OS command injection via SMS management lets remote attackers run commandsInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGH7.7Moxa OnCell G3150A-LTE: hard-coded key lets attackers impersonate devicesInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGH7.6Moxa MRC Client: improper certificate validation enables server impersonationInfrastructure2026-10-27 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Jupiter X Core WordPress plugin: stored XSS via forget_password_linkPackage2026-10-27 08:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Qt: out-of-bounds read in TSCII text encoding can crash applicationsPackage2026-10-27 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.8GSS Deployment Server: hardcoded key decrypts stored domain and service passwordsOther2026-10-27 08:16 UTCby EPSS–WHAT TO DO HIGHINCIDENTLinear: Problems loading applicationLinearVendor2026-10-27 08:07 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Some customers may notice their Pages and/or workers builds are intermittently failing.CloudflareVendor2026-10-27 08:04 UTCby status page–WHAT TO DO LOWINCIDENTOpenAI: Elevated error rates for most hosted Code Reviews and Security Reviews on private GitHub repositoriesOpenAIVendor2026-10-27 08:00 UTCby status page–WHAT TO DO LOWINCIDENTGitHub: Elevated 404s for GitHub App s2s tokens in git/APIGitHubVendor2026-10-27 08:00 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm)@camera.ui/camera-ui-nvr-windows-amd64Package2026-10-27 07:54 UTCby osv-malicious–UNINSTALL HIGH8.8WordPress Kirki plugin: subscriber can overwrite admin password via object injectionPackage2026-10-27 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.3qs: empty-array keys skip encoding, letting callers inject query parametersPackage2026-10-27 06:42 UTCby EPSS–WHAT TO DO HIGH7.5FortiOS: improper locking lets crafted HTTP requests knock out management HTTPSInfrastructure2026-10-27 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Qt: NTLM challenge parsing reads out of bounds, leaking heap memoryRuntime2026-10-27 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3PayDunya WooCommerce plugin: forged payment notices mark orders paidPackage2026-10-27 07:16 UTCby EPSS–WHAT TO DO LOW3.7TiendaCrypto WooCommerce plugin: forged payment webhooks mark orders as paidPackage2026-10-27 07:16 UTCby EPSS–WHAT TO DO HIGHCAMPAIGNEXPLOITEDCameraSwarmDahua IP cameras and DVRs taken over via Easy4IP P2P cloud by guessing serial numbers, weak passwords and old auth bypassesDahua IP camerasInfrastructure2026-10-27 06:34 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3Psono Server: prefixed deployments let write-only API keys read secretsPackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Psono Server: user-chosen Duo host enables internal network probingPackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Psono Server: WebAuthn challenge reuse lets a captured login bypass second factorPackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Psono Server: read-only users can append data to owners' filesPackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Psono Server: restricted API keys can claim full read-write sessionsOther2026-10-27 06:17 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Analytics Insights plugin: stored XSS via page titlePackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPayex WooCommerce plugin: forged payment notices mark orders paidpayex-payment-gateway-for-woocommercePackage2026-10-27 06:17 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDWompi WordPress plugin: forged payment callbacks mark orders paidPackage2026-10-27 06:17 UTCby EPSS–WHAT TO DO HIGHTECHNIQUEGoAhead embedded web server TLS bugs accept revoked client certificates and make some TLS 1.2 sessions decryptableGoAhead1 talkingInfrastructure2026-10-26by InfraStack Analyst1talkingFIX 6.1.1 MEDIUMINCIDENTTwilio: SMS Delivery Receipt Delays from a Subset of Twilio Long Codes to AT&T United StatesTwilioVendor2026-10-27 03:53 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in h13t0ry-hello-demo (PyPI)h13t0ry-hello-demoPackage2026-10-27 03:49 UTCby osv-malicious–UNINSTALL MEDIUM6.8ASUS motherboard firmware: untrusted pointer lets kernel-level user tamper or crashInfrastructure2026-10-27 03:16 UTCby EPSS–WHAT TO DO MEDIUM4.0HR-Payroll-Management-System: chat.php ID parameter allows cross-site scriptingPackage2026-10-27 02:16 UTCby EPSS–WHAT TO DO MEDIUM4.0Online Payroll Management System: chat.php ID parameter allows cross-site scriptingOther2026-10-27 02:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays Between a Subset of Twilio Long Codes and Multiple Networks in South AfricaTwilioVendor2026-10-27 01:34 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDWithdrawn CVE: maintainers say the reported issue is not a vulnerabilityOther2026-10-27 01:19 UTCby NVD–WHAT TO DO MEDIUM6.3ftpserverlib: FTP transfers can run unencrypted despite mandatory TLSPackage2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH8.8Mistral Vibe: untrusted git repo runs attacker commands on worktree startAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.9DevilutionX: crafted MPQ archive overflows heap, crashes the gamePackage2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.8DevilutionX: crafted MPQ archive causes out-of-bounds heap read and crashRuntime2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.9llama.cpp: crafted GGUF model file causes out-of-bounds readsAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH7.1airMAX M devices: cross-site request forgery lets lured users change settingsInfrastructure2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH8.8airMAX M devices: CSRF lets a lured user trigger command injectionInfrastructure2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH8.8Ubiquiti airMAX devices: heap overflow lets adjacent attacker run codeInfrastructure2026-10-27 01:19 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8airMAX M devices: stored XSS lets adjacent attacker escalate privilegesInfrastructure2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.9llama.cpp: crafted GGUF model file overflows tensor sizes, enabling out-of-bounds memory accessAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH8.5llama.cpp: crafted GGUF model tokenizer writes heap memory out of boundsAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH7.5Simple Content Management System: admin page lacks authorization checksOther2026-10-27 01:19 UTCby EPSS–WHAT TO DO HIGH7.5RapidJSON: out-of-bounds read in regex parser lets remote attackers leak memoryPackage2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.4VideoLLaMA2: model loader skips integrity check on attacker-chosen model pathAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM5.5SourceCodester Online Food Ordering System: order.php trusts client-side price valuesOther2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.8llama.cpp: crafted GGUF model file crashes model loading via heap over-readAI agents & MCP2025-06-25 06:26 UTCby EPSS–WHAT TO DO HIGH8.8llama.cpp: out-of-bounds read via unvalidated token IDs in llama-serverAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.9llama.cpp: crafted GGUF model file reads memory outside the modelAI agents & MCP2026-10-27 01:19 UTCby EPSS–WHAT TO DO MEDIUM6.9YesWiki: SQL injection in despam.php lets admins read the databasePackage2026-10-12 10:19 UTCby EPSS–WHAT TO DO HIGH8.2YesWiki: Bazar CSV import lets admins make server-side requests to internal hostsPackage2026-10-12 10:22 UTCby EPSS–WHAT TO DO HIGH8.2YesWiki: admin SSRF in page duplication reads local files and metadataPackage2026-10-12 10:24 UTCby EPSS–WHAT TO DO HIGH8.3YesWiki: captured ActivityPub requests can be replayed to repeat actionsPackage2026-10-12 10:26 UTCby EPSS–WHAT TO DO MEDIUM6.1YesWiki: stored XSS via Referer header in referrers pagePackage2026-10-12 10:28 UTCby EPSS–WHAT TO DO MEDIUM6.1YesWiki: crafted links inject JavaScript into pages via query parametersPackage2026-10-12 10:29 UTCby EPSS–WHAT TO DO MEDIUM6.9YesWiki: path traversal in BazarListeAction lets anyone pick templatesPackage2026-10-12 10:31 UTCby EPSS–WHAT TO DO HIGH7.1YesWiki: wildcard usernames let self-registered users read restricted pagesRuntime2026-10-12 10:44 UTCby EPSS–WHAT TO DO MEDIUM6.9YesWiki: unauthenticated showreq parameter leaks assembled SQL queriesRuntime2026-10-12 10:46 UTCby EPSS–WHAT TO DO HIGH8.5OpenPanel: read-only project members can see plaintext integration secretsPackage2026-10-11 21:07 UTCby EPSS–WHAT TO DO HIGH8.8OpenPanel: unauthenticated SQL injection leaks other tenants' analytics dataPackage2026-10-11 21:06 UTCby EPSS–WHAT TO DO MEDIUM6.9OpenPanel: unauthenticated Bull Board dashboard exposes queue controls on worker portPackage2026-10-11 21:04 UTCby EPSS–WHAT TO DO MEDIUM5.3OpenPanel: backslashes in event names break Sankey chart queriesOther2026-10-11 20:58 UTCby EPSS–WHAT TO DO HIGH7.1OpenPanel: startup logs leak database URLs and password-reset tokensPackage2026-10-12 10:28 UTCby EPSS–WHAT TO DO HIGH7.1OpenPanel: SQL injection lets members read other tenants' analytics dataPackage2026-10-11 20:53 UTCby EPSS–WHAT TO DO HIGH7.1OpenPanel: SQL injection in cohort filters reads other tenants' analytics dataOther2026-10-11 19:44 UTCby EPSS–WHAT TO DO HIGH8.8OpenPanel: js-runtime sandbox escape lets project members run codeRuntime2026-10-11 19:40 UTCby EPSS–WHAT TO DO MEDIUM6.9OpenPanel: unauthenticated callers can read other projects' chart annotationsPackage2026-10-11 21:02 UTCby EPSS–WHAT TO DO MEDIUM6.9OpenPanel: unauthenticated requests read bot events from private projectsPackage2026-10-11 19:35 UTCby EPSS–WHAT TO DO HIGH8.6OpenPanel: SQL injection in profile.values lets users read other tenants' dataOther2026-10-11 19:30 UTCby EPSS–WHAT TO DO HIGH7.0OpenPanel: SQL injection in profile filters lets users read other projects' eventsPackage2026-10-11 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.4OpenPanel: non-admin members can create projects and write-type ingestion credentialsOther2026-10-11 21:11 UTCby EPSS–WHAT TO DO MEDIUM5.3OpenPanel: read-level members can fetch ingestion credential hashesOther2026-10-11 21:10 UTCby EPSS–WHAT TO DO MEDIUM6.1DOMPurify: SAFE_FOR_TEMPLATES bypass lets template expressions survive sanitizationPackage2026-10-12 12:40 UTCby EPSS–WHAT TO DO MEDIUM6.1DOMPurify: IN_PLACE hook removal leaves event handlers active, enabling XSSPackage2026-10-12 12:40 UTCby EPSS–WHAT TO DO MEDIUM6.1DOMPurify: SMIL attribute case bypass lets SVG run script on clickPackage2026-10-12 12:40 UTCby EPSS–WHAT TO DO MEDIUM5.3Parse Server: relation queries skip owner ACL check, leaking linked object IDsPackage2026-10-11 21:52 UTCby EPSS–WHAT TO DO MEDIUM6.9WWBN AVideo: crafted Accept-Language header includes server PHP filesPackage2026-10-12 13:41 UTCby EPSS–WHAT TO DO MEDIUM6.5SourceCodester Online Food Ordering System: admin delete endpoint lacks authenticationOther2026-10-27 00:17 UTCby EPSS–WHAT TO DO MEDIUM5.8SourceCodester Online Food Ordering System: unrestricted file upload via admin add_foodOther2026-10-27 00:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAirflow SSH provider: templated environment values run shell commands remotelyPackage2026-10-27 00:17 UTCby EPSS–WHAT TO DO HIGH7.8Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might…AI agents & MCP2026-10-27by EPSS–WHAT TO DO HIGHNOT SCOREDCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassAI agents & MCP2026-10-27by Vendor & lab pages–WHAT TO DO HIGHTECHNIQUEUnpatched Godot DTLS flaw lets one unauthenticated UDP datagram overflow the heap and crash Godot game servers or clientsGodot EngineRuntime2026-10-27by InfraStack Analyst–WHAT TO DO MEDIUMTECHNIQUEUnpatched Godot 4 multiplayer flaw lets a malicious game server crash every client that joins with one crafted packetGodot EngineRuntime2026-10-27by InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDON'T CLICKSkyW4lkerSkyW4lker x365 SentinelSkyW4lker device-code phishing kit takes over Microsoft 365 accounts without stealing passwords, mainly at US companiesMicrosoft 365Vendor2026-10-27by InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNEXPLOITEDGhostActionGhostAction uses stolen GitHub tokens to plant credential-stealing workflows and a fake-font VS Code stealer in thousands of reposGitHub Actions2 talkingPackage2026-10-27by InfraStack Analyst2talkingWHAT TO DO

Monday, Oct 26Tuesday, Oct 27Wednesday, Oct 28