Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 841 threats · Wednesday, Oct 28· last check 2026-11-04 06:31 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Wednesday, Oct 28

Most severe in everything

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Attackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own RubyGitLab10 talking

EXPLOITED IN THE WILD

Cisco ASA and FTD: crafted SSL VPN request forces device reloadCisco Secure Firewall ASA Software and Cisco Secure FTD Software3 talking

PHISHINGNO CVE YET

Phishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote accessHexnode UEM1 talking

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Volt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devicesVeloCloud Orchestrator3 talking

Wednesday, Oct 28

MEDIUMINCIDENTTwilio: Link Shortening Redirect Errors on Branded DomainsTwilioVendor2026-10-28 23:44 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDswift-crypto: unbounded input to P-384 VOPRF API can crash a processPackage2026-10-20 09:05 UTCby EPSS–WHAT TO DO HIGH8.1MailWatch: low-privilege users can release or delete other users' quarantined mailPackage2026-07-30 10:24 UTCby EPSS–WHAT TO DO MEDIUM6.5Open Object: scoped API token reads other object types' history recordsPackage2026-07-16 07:35 UTCby EPSS–WHAT TO DO MEDIUM5.4Domoticz: low-privilege users can run installed Lua parser scriptsPackage2026-08-07 13:43 UTCby EPSS–WHAT TO DO MEDIUM5.3InvoicePlane: guest users can approve or reject other clients' quotesPackage2026-09-28 13:14 UTCby EPSS–WHAT TO DO CRITICAL10.0D-Link DIR-505 router: web CGI flaw lets remote attackers plant a backdoorInfrastructure2026-10-28 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.3MusicFreeDesktop: Request Forwarder flaw leaks information to local networkPackage2026-10-28 23:17 UTCby EPSS–WHAT TO DO HIGH7.5MusicFreeDesktop: request forwarder lets remote users trigger server-side request forgeryPackage2026-10-28 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111575 was withdrawn by its numbering authority, no flawOther2026-10-28 23:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111486 withdrawn by its CNA, no vulnerabilityOther2026-10-28 23:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111478 withdrawn by its CVE Numbering Authority, no flawOther2026-10-28 23:17 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in b20miner (npm)b20minerPackage2026-10-28 23:16 UTCby osv-malicious–UNINSTALL MEDIUMCAMPAIGNEXPLOITEDFake GrapheneOS download site (installgarphenos[.]ink) serves Mac malware as GrapheneOS.zipmacOSOther2026-10-28 22:10 UTCby InfraStack Analyst–WHAT TO DO HIGH8.0Mattermost: forged mention reminder lets a post trigger plugin replacement and server code executionPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM4.7AVideo: queue filename title lets stored XSS run in admin browsersPackage2026-06-22 16:00 UTCby EPSS–WHAT TO DO MEDIUM6.1AVideo: login page reflects input unescaped, enabling script injectionPackage2026-06-22 15:57 UTCby EPSS–WHAT TO DO HIGH8.6AVideo: unauthenticated SSRF reads internal responses and cloud metadata credentialsPackage2026-06-22 15:54 UTCby EPSS–WHAT TO DO HIGH7.3AVideo: unauthenticated encoder endpoints expose queue data and trigger processingPackage2026-06-22 15:44 UTCby EPSS–WHAT TO DO HIGH7.5AVideo: unauthenticated SQL injection in streamer login reads databasePackage2026-06-22 15:39 UTCby EPSS–WHAT TO DO CRITICAL10.0AVideo: unauthenticated live-stream endpoint lets attackers run OS commandsPackage2026-06-22 14:59 UTCby EPSS–WHAT TO DO CRITICAL10.0AVideo: unauthenticated installer writes PHP config, enabling remote code executionPackage2026-06-22 14:47 UTCby EPSS–WHAT TO DO HIGH8.8AnkiMCP: DNS rebinding lets web pages reach local Anki collectionPackage2026-06-18 11:44 UTCby EPSS–WHAT TO DO MEDIUM6.2Blombooru: admin image proxy fetches internal addresses, exposing cloud metadataOther2026-06-22 13:43 UTCby EPSS–WHAT TO DO HIGH7.6OpenCATS: date filters in activity grids allow SQL injectionPackage2026-06-22 14:09 UTCby EPSS–WHAT TO DO HIGH7.2OpenCATS: license key input writes PHP code into config.phpPackage2026-06-22 15:01 UTCby EPSS–WHAT TO DO HIGH7.5Bricks Builder: unauthenticated REST call exposes drafts, private posts and couponsPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH7.5Bricks Theme: unauthenticated REST injection leaks password hashes and user dataPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.9PiWeb WooCommerce payment plugin lets anyone alter other customers' ordersPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.7gopass: path traversal lets a store collaborator delete arbitrary directoriesPackage2026-08-12 11:22 UTCby EPSS–WHAT TO DO HIGH8.6Volmarg Personal Management System: authenticated users run shell commands via folder pathspersonal-management-systemPackage2026-10-28 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9Dolibarr ERP CRM: unauthenticated users can read unpublished job draftsPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH8.5FreeImage fork: crafted GIF frame overflows heap and corrupts memoryPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH8.5FreeImage fork: heap overflow in PBM image decoder lets crafted files write memoryPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH8.7python-markdown2: unclosed link syntax lets remote users exhaust CPUPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM5.6CherryTree: crafted documents can embed local files like SSH keysOther2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH7.1CherryTree: crafted web links run shell commands when clickedcherrytreePackage2026-10-28 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3xianyu-auto-reply-fix: unauthenticated message sending via hard-coded default API keyOther2026-10-28 22:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Signal K Server: unauthenticated log download leaks keys, enabling full admin takeoverPackage2026-09-21 19:20 UTCby EPSS–WHAT TO DO HIGH8.7OvenMediaEngine: crafted OVT packets stall connections and exhaust memoryOther2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH7.7ClashMi: default TLS certificate check off lets forged updates run codeOther2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH8.4OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientoauthlibPackage2026-10-24 18:41 UTCby EPSS–FIX 4.0.0 MEDIUM6.5a2ui: renderer flaw lets remote input control dynamically determined object attributesPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM5.3a2ui: unvalidated url argument in Image/Video/Audio player componentPackage2026-10-28 22:17 UTCby EPSS–WHAT TO DO HIGH7.6DB Tools: Go TLS trust store lacks eMudhra CA denylist entriesOther2026-10-28 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.5knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionknative.dev/pkgPackage2026-10-28 21:20 UTCby GitHub Advisories–FIX 0.0.0-20260531000007-52dbd5ece63f MEDIUM6.5Waline login accepts a non-string email as a match-all MongoDB query@waline/vercelPackage2026-10-28 21:17 UTCby GitHub Advisories–FIX 1.41.0 HIGH8.2decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsdecode-uri-componentPackage2026-10-23 12:48 UTCby EPSS–FIX 0.5.1 MEDIUM6.9Vite: `server.fs.deny` bypassed with queriesvitePackage2026-10-21 05:36 UTCby EPSS–FIX 6.4.5 HIGH7.5Happy DOM: server renderer proxies unauthenticated requests to internal servicesPackage2026-10-15 22:59 UTCby EPSS–WHAT TO DO HIGH8.6LangGraph JavaScript custom authentication may permit cross-user Store accesslanggraph-apiAI agents & MCP2026-09-28 14:44 UTCby EPSS–FIX 0.15.0 MEDIUM5.3filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdfilelockPackage2026-10-28 21:09 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM5.3filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLfilelockPackage2026-10-28 21:08 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM5.8filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesfilelockPackage2026-10-28 21:08 UTCby GitHub Advisories–FIX 4.2.1 HIGH8.6Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLhappy-domPackage2026-10-12 19:54 UTCby EPSS–FIX 21.0.0 MEDIUM6.5Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookieshappy-domPackage2026-10-08 23:18 UTCby EPSS–FIX 20.14.6 MEDIUM4.3LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestslanggraph-sdkAI agents & MCP2026-10-07 17:31 UTCby EPSS–FIX 0.4.6 HIGH8.2GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications@graphql-tools/executor-legacy-wsPackage2026-09-30 21:42 UTCby EPSS–FIX 1.1.36 MEDIUM6.0GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller@graphql-tools/executor-legacy-wsPackage2026-09-30 21:41 UTCby EPSS–FIX 1.1.36 MEDIUM5.3@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths@hono/node-serverPackage2026-09-29 06:17 UTCby EPSS–FIX 2.1.3 MEDIUM5.9Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headersgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 MEDIUM6.1Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURIgithub.com/labstack/echo/v5Runtime2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 MEDIUM4.7Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Protogithub.com/labstack/echo/v5Package2026-09-27 18:47 UTCby EPSS–FIX 5.1.1 MEDIUMINCIDENTCloudflare: Increased latency and error rate for R2 in ENAMCloudflareVendor2026-10-28 21:01 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @zaip-ai/cli (npm)@zaip-ai/cliPackage2026-10-28 20:37 UTCby osv-malicious–UNINSTALL HIGH8.8BPMN System REST APIs: weak input validation allows authenticated command executionOther2026-10-28 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6EXPLOITEDCisco ASA and FTD: crafted SSL VPN request forces device reloadCisco Secure Firewall ASA Software and Cisco Secure FTD Software3 talkingInfrastructure2026-10-28 20:18 UTCby InfraStack Analyst3talkingWHAT TO DO HIGH7.4WSO2 Identity Server: mixed-case usernames let revoked OAuth tokens stay validPackage2026-10-28 20:18 UTCby EPSS–WHAT TO DO CRITICAL9.4FearlessCMS: unauthenticated admin scripts allow file writes and site defacementOther2026-06-30 04:43 UTCby EPSS–WHAT TO DO HIGH8.6Gearboy: unauthenticated network MCP server lets peers control emulatorAI agents & MCP2026-06-12 19:49 UTCby EPSS–WHAT TO DO MEDIUM4.7Endatix: stored submission file URLs let staff trigger server-side requestsPackage2026-06-22 07:53 UTCby EPSS–WHAT TO DO MEDIUM4.7Ember: terminal escape codes in request URIs spoof the Caddy dashboardPackage2026-06-22 07:21 UTCby EPSS–WHAT TO DO LOW3.1OAuth2 token introspection cache keeps revoked tokens after revocation requestOther2026-10-28 20:17 UTCby EPSS–WHAT TO DO HIGH7.7KServe: namespace users can make the storage initializer send requests from inside the clusterInfrastructure2026-10-28 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Authentication endpoint error page reflects request data, enabling browser script injectionOther2026-10-28 20:17 UTCby EPSS–WHAT TO DO MEDIUM5.9Echo has a Static Middleware Double-Unescape Path Traversalgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.2.0 MEDIUM5.9Echo static file middleware route protection bypass via encoded dot-dot traversalgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 CRITICAL9.1ai-gateway-payload-processing: tenants can use other tenants' LLM API keysAI agents & MCP2026-10-28 20:17 UTCby EPSS–WHAT TO DO HIGH8.1Samba: case mismatch in vfs_ceph_rgw lets users overwrite restricted filesPackage2026-10-28 20:17 UTCby EPSS–WHAT TO DO HIGH8.3WSO2 product: unauthenticated SSRF lets attackers reach internal network resourcesInfrastructure2026-10-28 20:17 UTCby EPSS–WHAT TO DO LOWINCIDENTLinear: Some Slack integrations have been unexpectedly archivedLinearVendor2026-10-28 20:12 UTCby status page–WHAT TO DO HIGH7.5Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 MEDIUM6.1Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlobgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 MEDIUM5.3Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configurationgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.1.0 MEDIUM5.3Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Methodgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 MEDIUM5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaultgithub.com/labstack/echo/v5Package2026-09-27 23:04 UTCby EPSS–FIX 5.4.0 HIGH8.2mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6mcp-sanitizerPackage2026-10-28 19:51 UTCby GitHub Advisories–FIX 1.4.0 HIGH7.5mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Pathsmcp-sanitizerPackage2026-10-28 19:51 UTCby GitHub Advisories–FIX 1.4.0 HIGH8.8rucio has an Authorization Bypass on REST API endpoint for signing URLsrucioPackage2026-10-28 19:50 UTCby GitHub Advisories–FIX 35.9.0 MEDIUMNOT SCOREDMySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)MySqlConnectorPackage2026-10-28 19:49 UTCby GitHub Advisories–FIX 2.6.1 LOWNOT SCOREDCaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughgithub.com/caddyserver/caddy/v2Runtime2026-10-28 19:49 UTCby GitHub Advisories–FIX 2.11.5 HIGH8.8Wasmtime WASI: rename lets sandboxed guest reach host directories on macOS and FreeBSDPackage2026-10-14 17:23 UTCby EPSS–WHAT TO DO HIGH8.3Coder: GCE identity token replay yields workspace agent session tokenPackage2026-10-13 09:57 UTCby EPSS–WHAT TO DO HIGH8.7EspoCRM: password-redaction regex lets unauthenticated requests exhaust CPUPackage2026-10-13 19:42 UTCby EPSS–WHAT TO DO MEDIUM6.9ToolJet: signup guard ignores disabled setting, letting anyone create accountsRuntime2026-10-13 08:07 UTCby EPSS–WHAT TO DO HIGH8.2MONAI: hash check silently passes when no hash given, enabling file substitutionPackage2026-10-13 13:54 UTCby EPSS–WHAT TO DO HIGH8.8MONAI: malicious bundle's logging config runs arbitrary Python on loadPackage2026-10-13 13:07 UTCby EPSS–WHAT TO DO MEDIUM6.3go-chi chi: SupressNotFound middleware lets unauthenticated requests skip mounted authPackage2026-10-14 13:24 UTCby EPSS–WHAT TO DO MEDIUM5.9SiYuan: Windows path alias bypass copies API token and TLS key publiclyPackage2026-10-13 05:22 UTCby EPSS–WHAT TO DO HIGH7.5n8n: Slack Trigger webhook lets unauthenticated attackers steal Slack tokensAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH7.1n8n: prototype pollution via workflow connection keys breaks logins and writesAI agents & MCP2026-10-14 09:34 UTCby EPSS–WHAT TO DO MEDIUM5.9n8n Local Gateway: deep link silently re-pairs to attacker instanceAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH7.1n8n: member users can run workflows with credentials they cannot accessAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH7.1n8n: workflow editors can read restricted credentials via sub-workflow loadingAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH8.7n8n: crafted workflow ID lets members access every project's Data Table rowsAI agents & MCP2026-10-14 09:35 UTCby EPSS–WHAT TO DO HIGH8.4n8n: webhook error responses omit CSP, enabling stored cross-site scriptingAI agents & MCP2026-10-14 09:35 UTCby EPSS–WHAT TO DO HIGH8.2n8n: SeaTable Trigger token leaks into execution logs for viewersAI agents & MCP2026-10-14 09:44 UTCby EPSS–WHAT TO DO HIGH7.1n8n: crafted glob pattern lets a workflow member freeze the serverAI agents & MCP2026-10-14 09:36 UTCby EPSS–WHAT TO DO HIGH8.7n8n: Quick Base node filter injection lets attackers read or delete all recordsAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH7.7n8n: failed-workflow error handler inherits another user's identity and credentialsAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO HIGH8.2n8n: failed Git, MongoDB and GCS nodes leak credential secrets in execution dataAI agents & MCP2026-10-14 09:37 UTCby EPSS–WHAT TO DO HIGH7.1n8n: authenticated members can exfiltrate credentials they lack access toAI agents & MCP2026-10-14 09:44 UTCby EPSS–WHAT TO DO HIGH7.5n8n: OData filter injection in Outlook and SharePoint nodes exposes contactsAI agents & MCP2026-10-14 09:44 UTCby EPSS–WHAT TO DO MEDIUM5.4n8n: chat-only users can register restricted tools and run workflowsAI agents & MCP2026-10-14 09:43 UTCby EPSS–WHAT TO DO CRITICAL9.2Sophos UTM: path traversal lets unauthenticated remote attackers run code as rootInfrastructure2026-10-28 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.3opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingio.opentelemetry:opentelemetry-apiPackage2026-10-14 18:56 UTCby EPSS–FIX 1.67.0 LOW3.7i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringi18next-http-backendPackage2026-10-18 06:20 UTCby EPSS–FIX 4.0.4 HIGH7.2Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesvue-i18nPackage2026-10-10 11:52 UTCby EPSS–WHAT TO DO LOW2.1Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listvue-i18nPackage2026-10-10 11:53 UTCby EPSS–FIX 11.4.14 HIGH8.4Highcharts Grid: `javascript:` URL in credits.href runs script on click@highcharts/dashboardsPackage2026-09-29 11:50 UTCby EPSS–FIX 4.0.0 HIGH8.6Highcharts Grid parses pagination language options as HTML@highcharts/grid-litePackage2026-09-29 11:49 UTCby EPSS–FIX 3.2.0 HIGH8.4Highcharts Dashboards parses fullscreen labels as HTML@highcharts/dashboardsPackage2026-09-29 11:49 UTCby EPSS–FIX 4.2.3 HIGH8.4Highcharts Dashboards parses sidebar component labels as HTML@highcharts/dashboardsPackage2026-09-29 11:48 UTCby EPSS–FIX 4.2.3 HIGH8.4Highcharts: javascript: URL in credits.href runs script on clickhighchartsPackage2026-09-29 11:48 UTCby EPSS–FIX 11.4.9 MEDIUMNOT SCOREDchrome-devtools-mcp: policy flaw lets local attacker read and write filesAI agents & MCP2026-10-22 12:14 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in itsa-utils (npm)itsa-utilsPackage2026-10-28 18:25 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in itsa-react-checkbox (npm)itsa-react-checkboxPackage2026-10-28 18:23 UTCby osv-malicious–UNINSTALL HIGH8.1JBoss EAP: unauthenticated remote class loading via CDR codebase URLsRuntime2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.0Grafana: server logs can leak OAuth and OIDC tokens to log readersRuntime2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Don't Starve Together: malformed server data crashes game client remotelyOther2026-10-28 18:17 UTCby EPSS–WHAT TO DO HIGH7.2Highcharts: dotted series.keys paths write to Object.prototypehighchartsPackage2026-09-29 11:47 UTCby EPSS–FIX 12.6.1 HIGH7.2Highcharts: series column construction writes to Object.prototypehighchartsPackage2026-09-29 11:47 UTCby EPSS–FIX 13.1.0 MEDIUM6.9Highcharts Dashboards: prototype pollution via edit mode lets an attacker alter page JavaScriptPackage2026-09-29 11:47 UTCby EPSS–WHAT TO DO MEDIUM6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.@highcharts/dashboardsPackage2026-09-29 11:44 UTCby EPSS–FIX 4.2.2 HIGH8.4Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributeshighchartsPackage2026-09-29 11:46 UTCby EPSS–FIX 11.4.9 HIGH8.6Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace@highcharts/dashboardsPackage2026-09-29 11:45 UTCby EPSS–FIX 4.2.2 HIGH7.2Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printinghighchartsPackage2026-09-29 11:43 UTCby EPSS–FIX 12.6.1 MEDIUM5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`@highcharts/dashboardsPackage2026-09-29 11:44 UTCby EPSS–FIX 4.2.2 HIGH8.5Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`@highcharts/grid-litePackage2026-09-29 11:45 UTCby EPSS–FIX 3.2.0 HIGHNOT SCOREDPerl HTTP::Body: chunked request bodies exhaust server memoryPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDHTTP::Body (Perl): crafted multipart filename causes CPU exhaustion via regexPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO HIGH8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`@highcharts/grid-proPackage2026-09-29 11:46 UTCby EPSS–FIX 3.2.0 HIGH7.2Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartshighchartsPackage2026-09-29 11:43 UTCby EPSS–FIX 11.4.9 HIGH7.5RE2JS: Quadratic-time denial of service in re2js lookbehind matchingre2jsPackage2026-10-17 21:03 UTCby EPSS–FIX 2.8.7 HIGH8.3russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationrusshPackage2026-10-25 16:50 UTCby EPSS–FIX 0.65 NOT SCOREDNOT SCOREDPerl HTTP::Body: chunked request parsing can hang or smuggle requestsPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDHTTP::Body for Perl: chunked request parsing lets remote clients exhaust CPUPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Parser: no default part limit lets crafted email exhaust memoryPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Field::ParamVal: duplicate boundary check lets mail hide attachmentsPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Parser: symlinks let local users redirect attachment writesPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Words: repeated encoded-word markers exhaust memory during mail parsingPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDPerl MIME::Field::ParamVal: hyphenated RFC 2231 language tag hides attachment filenamePackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDPerl MIME::Field::ParamVal: unclosed comments cause CPU exhaustion during parsingPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Parser: truncated deep nesting exhausts memory when parsing mailPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl MIME::Head: partly encoded boundary hides attachments from mail filtersPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDPerl MIME::Field::ParamVal: ambiguous RFC 2231 multipart boundaries go unflaggedPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDPerl MIME::Parser: invalid Content-Type parameter hides multipart boundary from filtersPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDPerl HTTP::Body: mixed-case percent escapes dropped from form fieldsPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPerl HTTP::Body: unbounded multipart headers let one request exhaust memoryPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl HTTP::Body: malformed multipart upload burns CPU via quadratic rescanningPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDPerl HTTP::Body: incomplete multipart uploads leave temp files on diskPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPerl HTTP::Body: unlimited form fields let one request exhaust memoryPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.3PostgreSQL Anonymizer: original data statistics leak through pg_stats after maskingPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.3PostgreSQL Anonymizer: partial() masking can reveal whole short valuesPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5PostgreSQL Anonymizer: anonymization functions bypass checks, exposing masked dataPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5PostgreSQL Anonymizer: sub-query results in masking rules are returned unmaskedPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.8PostgreSQL Anonymizer: masking skipped for data read through security_invoker viewsPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.7PostgreSQL Anonymizer: partition and inheritance tables leak unmasked data via parentPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5PostgreSQL Anonymizer: cached plans keep showing unmasked data after rule changesPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.7PostgreSQL Anonymizer: salt and shift readable by low-privilege database usersPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO LOW3.5PostgreSQL Anonymizer: masked roles can read statistics histograms and MCVsPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.7PostgreSQL Anonymizer: image_blur accepts oversized image dimensions, exhausting memoryPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUM4.7PostgreSQL Anonymizer: range dummy functions allow unbounded memory usePackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO LOW3.5PostgreSQL Anonymizer: data-modifying CTEs bypass read-only masked rolesPackage2026-10-28 18:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCircleCI: Delays for gen2 dedicated IP range jobsCircleCIVendor2026-10-28 18:15 UTCby status page–WHAT TO DO MEDIUM5.3X.Org X Server: use-after-free in gesture sprites lets clients crash itInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.9X.Org X Server: keyboard map check lets clients read server memoryInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8X.Org X Server: out-of-range modifier in XIPassiveUngrabDevice overflows heapInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.7Grafana: Azure Monitor data source leaks access token via server-side requestsgrafanaPackage2026-10-28 17:18 UTCby InfraStack Analyst–FIX 13.3.0 MEDIUM6.5Grafana: crafted math expression crashes the server, and it persists across restartsPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache Kafka: crafted FetchSnapshot request crashes the controller processPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.5Zephyr: Ethernet header prepend writes out of bounds on forwarded packetsRuntime2026-10-28 15:56 UTCby EPSS–WHAT TO DO HIGH7.8Zephyr: GPIO syscalls skip pin validation, letting user threads write kernel memoryRuntime2026-10-27 17:54 UTCby EPSS–WHAT TO DO HIGH8.8Ultralytics: Google Drive download path traversal allows code executionPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Ultralytics: unvalidated string in parse_model runs Python codeultralyticsPackage2026-10-28 17:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Ultralytics: untrusted dataset cache file runs code when openedPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Ultralytics: crafted model config string runs attacker Python codePackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Ultralytics: command injection in torch_safe_load runs code on openPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Ultralytics: unvalidated dataset string lets a file run Python codePackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Ultralytics: untrusted model file deserialization lets attackers run codePackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.8Alpine iLX-F511 car stereo: Bluetooth OBEX packets run code as rootInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH8.8Alpine iLX-F511 car stereo: Android Auto service lets network attacker run root codeInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.8Alpine iLX-F511 car head unit: Android Auto handler overflow allows root code executionInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO LOW3.5Alpine iLX-F511 Bluetooth stack reads past buffer, leaks memoryInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.8Alpine iLX-F511 car head unit: diagapp command injection gives root code executionInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH8.8Alpine iLX-F511 head unit: exposed function lets network attackers run root codeiLX-F511Infrastructure2026-10-28 17:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.0Alpine iLX-F511 car head unit: Bluetooth pairing flaw lets attackers run code as rootInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.8Alpine iLX-F511 car head unit: stack overflow lets physical attacker run root codeInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH8.0Alpine iLX-F511 car stereo: vCard parsing overflow lets attacker run code as rootInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Alpine iLX-F511 head unit: local user escalates to root via Fiv serviceiLX-F511Infrastructure2026-10-28 17:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Alpine iLX-F511 head unit: hard-coded SSH credentials allow remote code executionInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUM6.9MongoDB Java Driver: BSON raw documents accepted with mismatched length, altering commandsPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGH8.8MongoDB integration library: relationship queries can expose or alter withheld documentsPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: path traversal check exposes file names and sizes to readersInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO LOWNOT SCOREDJenkins: missing permission check leaks HTTP proxy configuration detailsRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: incomplete deserialization check lets attackers inject nested configuration objectsInfrastructure2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDJenkins: breadcrumb tooltip text lets readers run stored cross-site scriptingPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: agent-sent exceptions enable cross-site scripting on the controllerOther2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDJenkins: workspace browser link computed on agent enables cross-site scriptingPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: low-privilege users can trigger admin warnings that overwrite account dataRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDJenkins: API token requests issue a remember-me cookie that outlives revocationRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDJenkins: setup endpoint lets unauthenticated attackers create an administrator accountPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDJenkins: symlink check race lets users write files anywhere on controllerRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: agent endpoint lets readers overwrite controller config filesRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDJenkins: item rename follows symlinks, letting users read controller filesRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDJenkins: older agent configs run arbitrary commands on the controllerRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: crafted config.xml uploads enable stored XSS via item typesRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDJenkins: deserialization filter skipped for classes named in resolves-toRuntime2026-10-28 17:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache Kafka Connect: validate endpoint leaks config provider secrets in plaintextPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache Kafka Connect: admin listener skips auth, exposing logger controlsPackage2026-10-28 17:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Kafka: crafted compressed batch can crash brokers with memory exhaustionPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Kafka: unauthorized config request reads broker files and environment variablesInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDKafka: crafted size fields force huge allocations, crashing consumers with OutOfMemoryErrorPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDKafka Streams: a far-future record timestamp hangs stream threads indefinitelyPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Kafka: crafted request header forces memory exhaustion and broker denial of servicePackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Kafka: protocol readers over-allocate memory from declared array lengthPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache Kafka: telemetry push lets a client exhaust broker heapPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDKafka: SASL/OAUTHBEARER broker accepts unsigned JWTs without a JWKS URLPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDKafka: OAUTHBEARER skips issuer and audience checks unless configuredPackage2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGH8.8Juniper Session Smart Router: config-write user can run commands as rootInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.9Grafana: authenticated users can read SSO secrets and change SSO settingsRuntime2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGH7.1Juniper Session Smart Router: DHCP decoder underflow leaks data, crashes serviceInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Juniper Session Smart Router: crafted TLS certificate crashes the DPI scannerSession Smart RouterInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–FIX 7.0.5 CRITICAL9.8PUBLIC EXPLOITJuniper Session Smart Router: unauthenticated network attacker gains admin via URL parametersInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGH8.8Juniper Session Smart Router: DHCP client overflow allows remote code executionSession Smart RouterInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–FIX 7.0.5 HIGH8.8Juniper Session Smart Router: REST user can read or delete arbitrary host filesInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Juniper Session Smart Conductor: crafted salt minion ID runs root commandsInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.8Juniper Session Smart Router: web server lets attackers inject arbitrary HTTP headersInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Juniper Session Smart Conductor: RoutingManager leaks routing credentials via /tmpInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGH8.8Juniper Session Smart Router: command injection via audit rule deletionInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Juniper Session Smart Router: unverified cache files let local users run codeInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Juniper Session Smart Router: link following lets local users overwrite root filesSession Smart RouterInfrastructure2026-10-28 17:17 UTCby InfraStack Analyst–FIX 7.0.5 MEDIUM5.5Juniper Session Smart Router: local user can unmount filesystems or crash emberInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO LOW3.7Juniper Session Smart Router: improper initialization lets attackers decrypt trafficInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Juniper Session Smart Router: VRRP flaw leaks memory or crashes the deviceInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Juniper Session Smart Router: oversized TCP SACK option corrupts session dataInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Juniper Session Smart Router: TCP option parsing writes out of boundsInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Juniper Session Smart Router: HTTP parser flaw lets a crafted request crash itInfrastructure2026-10-28 17:17 UTCby EPSS–WHAT TO DO HIGH7.7PUBLIC EXPLOITGrafana: contact point editors can redirect alerts and expose stored credentialsgrafanaOther2026-10-28 17:17 UTCby InfraStack Analyst–FIX 12.4.14 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in transaction-info-generate-sdk (npm)transaction-info-generate-sdkPackage2026-10-28 16:54 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mock-transactions-sdk (npm)mock-transactions-sdkPackage2026-10-28 16:54 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Long Codes to Orange BelgiumTwilioVendor2026-10-28 16:38 UTCby status page–WHAT TO DO MEDIUMINCIDENTSupabase: Delayed Log Delivery from 14:10 - 15:30 UTCSupabaseVendor2026-10-28 16:21 UTCby status page–WHAT TO DO MEDIUMINCIDENTAnthropic: Elevated errors affecting the Google Calendar connectorAnthropicVendor2026-10-28 16:19 UTCby status page–WHAT TO DO HIGH7.8X.Org X Server: CopyArea heap overflow lets clients crash or run codeRuntime2026-10-28 16:17 UTCby EPSS–WHAT TO DO HIGH7.8X.Org X Server: RandR request overflow lets a client crash or run codeInfrastructure2026-10-28 16:17 UTCby EPSS–WHAT TO DO HIGH7.1WordPress Ninja Forms: unauthenticated submissions can inject formulas into CSV exportsPackage2026-10-28 16:17 UTCby EPSS–WHAT TO DO HIGH8.3YosemiteCrew: any user can edit or delete other organizations' service and task dataPackage2026-06-21 21:02 UTCby EPSS–WHAT TO DO HIGH8.8Shopper admin: low-privilege staff can grant admin and delete rolesPackage2026-06-22 06:09 UTCby EPSS–WHAT TO DO MEDIUM4.3Xibo: missing authorization lets users alter display schedule criteriaPackage2026-06-21 18:44 UTCby EPSS–WHAT TO DO MEDIUM5.4Xibo: any logged-in user can read other users' layout statusOther2026-06-21 18:44 UTCby EPSS–WHAT TO DO MEDIUM6.5Xibo: any logged-in user can download admin notification attachmentsPackage2026-06-21 18:45 UTCby EPSS–WHAT TO DO HIGH7.5SimulationCraft: oversized socket list overflows gem arrays, enabling code executionPackage2026-06-22 04:11 UTCby EPSS–WHAT TO DO CRITICAL9.9XWiki Remote Macros: page editors can run code via excerpt-includePackage2026-06-21 19:03 UTCby EPSS–WHAT TO DO HIGH8.8FOG: API user can edit storage node fields and run commands as rootPackage2026-08-18 10:51 UTCby EPSS–WHAT TO DO HIGH7.0USB Test: malicious USB drive can corrupt heap and run codePackage2026-10-08 23:40 UTCby EPSS–WHAT TO DO HIGH8.5Kerio Connect Outlook Connector: local users can gain SYSTEM privilegesOther2026-10-28 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Kerio Connect Webmail: crafted email injects script into victim's sessionPackage2026-10-28 16:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in black-spindle (npm)black-spindlePackage2026-10-28 16:15 UTCby osv-malicious–UNINSTALL HIGHINCIDENTDatadog: Metrics query are disruptedDatadogVendor2026-10-28 16:10 UTCby status page–WHAT TO DO MEDIUMCAMPAIGNEXPLOITEDSilver FoxKong RATFake DeepSeek desktop-app sites pushed through search results install Silver Fox remote-access malware that kills antivirusDeepSeek1 talkingAI agents & MCP2026-10-15by InfraStack Analyst1talkingWHAT TO DO MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Failure Increase and Gateway API (Lookup API) Failure Increase on EE in United KingdomTwilioVendor2026-10-28 15:54 UTCby status page–WHAT TO DO HIGH7.8X.org X server: heap overflow lets authenticated clients run codeInfrastructure2026-10-28 15:17 UTCby EPSS–WHAT TO DO HIGH7.8X.Org X server: XFIXES pointer barrier overflow lets clients crash or run codeInfrastructure2026-10-28 15:17 UTCby EPSS–WHAT TO DO HIGH7.8X.org X server: integer truncation lets authenticated clients overflow heapInfrastructure2026-10-28 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.7OpenVPN ovpn-dco-win: local users can crash Windows via TCP raceInfrastructure2026-10-28 15:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDrybakit/msgpack: unbounded recursion in BufferUnpacker lets crafted input crash servicePackage2026-10-28 15:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDrybakit/msgpack: integer overflow in BufferUnpacker enables denial of servicePackage2026-10-28 15:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: On Call Engineers are InvestigatingTwilioVendor2026-10-28 14:18 UTCby status page–WHAT TO DO HIGH8.5X.org X server: GLX heap overflow lets an authenticated client run codeInfrastructure2026-10-28 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.8SAIL image library: malformed animated WebP crashes the decoderPackage2026-06-21 08:33 UTCby EPSS–WHAT TO DO HIGH8.5identrail: GitHub connect flow lets a tenant read other orgs' repositoriesPackage2026-06-20 21:20 UTCby EPSS–WHAT TO DO HIGH8.3OpenHop: unauthenticated path traversal reads and deletes YAML filesPackage2026-06-20 18:47 UTCby EPSS–WHAT TO DO HIGH8.8ESPHome Device Builder: LAN devices bypass auth on Home Assistant add-onPackage2026-06-20 18:31 UTCby EPSS–WHAT TO DO HIGH7.8Joker linter runs repository-supplied code when linting untrusted filesPackage2026-06-20 15:40 UTCby EPSS–WHAT TO DO HIGH7.1NORA registry: write-role tokens can revoke any user's tokenPackage2026-06-20 12:29 UTCby EPSS–WHAT TO DO HIGH7.1Xibo: authenticated users can edit or delete any layout's actionsPackage2026-06-21 18:45 UTCby EPSS–WHAT TO DO MEDIUM6.5Xibo: dataset CSV export skips access checks, leaking admin-created datasetsPackage2026-06-21 18:45 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Filter Everything plugin: object injection flaw through version 1.9.7Package2026-10-28 14:16 UTCby EPSS–WHAT TO DO HIGH8.8Phoenix Media Rename: untrusted data deserialization lets attackers inject objectsPackage2026-10-28 14:16 UTCby EPSS–WHAT TO DO HIGH8.7Bandit: HTTP/2 body reader lets remote clients exhaust server memoryPackage2026-10-28 13:25 UTCby EPSS–WHAT TO DO CRITICAL9.8Ultimate Member WordPress plugin: object injection through untrusted data deserializationPackage2026-10-28 14:16 UTCby EPSS–WHAT TO DO HIGH8.5Advanced Ads Tracking WordPress plugin: blind SQL injection before 4.0.0Package2026-10-28 14:16 UTCby EPSS–WHAT TO DO HIGH7.2Dokan lite WordPress plugin: object injection via untrusted deserializationPackage2026-10-28 14:16 UTCby EPSS–WHAT TO DO CRITICAL9.4Wing FTP Server: user base folder check lets admins write files outside itPackage2026-10-28 14:16 UTCby EPSS–WHAT TO DO CRITICALINCIDENTGitHub: Disruption with some Copilot servicesGitHubVendor2026-10-28 14:12 UTCby status page–WHAT TO DO MEDIUM5.5X.org X Server: use-after-free when adding or removing XInput master devicesInfrastructure2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.8X.org X Server: use-after-free lets a malicious X client crash or run codeInfrastructure2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.5HCL BigFix AEX: error handling leaks stack traces and internal pathsVendor2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.4HCL BigFix AEX: clickjacking lets a malicious page trick usersVendor2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM4.2HCL BigFix AEX: server-side request forgery lets attackers reach internal servicesVendor2026-10-28 13:17 UTCby EPSS–WHAT TO DO CRITICAL9.1HCL BigFix AEX: remote code execution lets attackers run codeBigFix AEXOther2026-10-28 13:17 UTCby InfraStack Analyst–FIX v14.0.0 HIGH8.6HCL BigFix AEX: unrestricted file upload lets attackers read and plant filesBigFix AEXInfrastructure2026-10-28 13:17 UTCby InfraStack Analyst–FIX v14.0.0 MEDIUM6.5Waline: login with non-string email reaches the admin accountPackage2026-06-12 02:44 UTCby EPSS–WHAT TO DO LOW3.7HCL BigFix AEX: aws-sdk flaw may send AWS requests to wrong endpointsVendor2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Telerik Document Processing: forged PDF signatures reported as valid and unmodifiedPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Telerik Document Processing: XML entity flaw lets crafted SVG read server filesPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.1Telerik Document Processing: AI agent tools allow file read and overwriteAI agents & MCP2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Telerik Document Processing: crafted spreadsheet can crash or hang the host processPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Telerik Document Processing: crafted PDF can hang or crash the host processPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Telerik Document Processing: crafted DOCX or RTF file crashes or hangs the hostPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Redux Framework: missing authorization lets attackers read cached sensitive dataPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5iHomefinder Optima Express: missing authorization exposes access control flawVendor2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.2PickPlugins Accordion WordPress plugin: untrusted data deserialization allows object injectionPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH8.8GS Logo Slider WordPress plugin: untrusted data deserialization enables object injectionPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.5WP Discussion Board WordPress plugin: stored XSS through 2.6.0Other2026-10-28 13:17 UTCby EPSS–WHAT TO DO CRITICAL9.6PUBLIC EXPLOITTopluyo Desktop for Linux: crafted link runs OS commands as userOther2026-10-27 16:00 UTCby EPSS–WHAT TO DO HIGH7.1SliceWP affiliate plugin: stored XSS through version 1.2.13Package2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.1GetPaid WordPress plugin: stored XSS in invoicing through 2.8.62Package2026-10-28 13:17 UTCby EPSS–WHAT TO DO CRITICAL9.3Crowd Favorite DXP ToolKit: SQL injection through version 2.0.1Other2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.1Crowd Favorite DXP ToolKit: stored XSS through 2.0.1 lets attackers run scriptsPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.1WordPress eCommerce Product Catalog plugin: reflected XSS through version 3.6.4Package2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.1Unlimited Elements for Elementor: reflected XSS lets attackers run scripts in visitors' browsersPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH7.5Supsystic Contact Form: plugin leaks embedded sensitive data in responsesPackage2026-10-28 13:17 UTCby EPSS–WHAT TO DO HIGH8.5BuddyPress: SQL injection flaw lets attackers query the databaseOther2026-10-28 13:17 UTCby EPSS–WHAT TO DO CRITICAL9.3FunnelKit Automations WordPress plugin: blind SQL injection through version 3.8.5.2Package2026-10-28 13:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Dell iDRAC Service Module: code injection lets a local admin escalate privilegesInfrastructure2026-10-28 12:17 UTCby EPSS–WHAT TO DO HIGH8.1Axel download accelerator: crafted URLs write files outside the working directoryPackage2026-10-28 12:17 UTCby EPSS–WHAT TO DO CRITICAL9.8KaliFast: Git remote endpoint lets a registered user run server commandsOther2026-10-28 12:17 UTCby EPSS–WHAT TO DO MEDIUM5.4WordPress My Auctions Allegro plugin: missing authorization check through 4.0.3Package2026-10-28 12:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Eclipse Che machine-exec: unescaped username lets network attackers run commandsOther2026-10-28 12:17 UTCby EPSS–WHAT TO DO MEDIUM5.3iCagenda Joomla extension: CSV export lets registration fields run formulasPackage2026-10-28 12:17 UTCby EPSS–WHAT TO DO HIGH8.6iCagenda Joomla extension: stored XSS through URL-type event custom fieldOther2026-10-28 12:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Failure Increase on Indosat in IndonesiaTwilioVendor2026-10-28 12:14 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio to MTC NamibiaTwilioVendor2026-10-28 11:22 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDLinux Hyper-V VMBus: connection state reset leaves host messages flowingInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: power supply unregister can free data during a running callbackRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel vc4 HDMI driver: audio can start before video, causing a warningRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel vsock: connect and reset race can corrupt memoryOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel RDS: failed route resolution frees connection id, causing use-after-freeRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: netlink socket filters can read uninitialized skb headroomRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel rocket accelerator driver: failed init leaves dangling error pointerInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Xe GPU driver null dereference during dma-buf evictionRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Intel Xe OA buffer can leak stale kernel memory to userspacePackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel SCSI target: lock can spin forever under interrupt completionOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: race in iSCSI discovery auth updates causes double-freeInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: scheduler race can leave a CPU idle with runnable tasksRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel OCFS2 DLM: debugfs read can use freed recovery memoryInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: failed fasync enable on FIFO leaves freed-file signal use-after-freeRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: SCSI libsas SMP command can deadlock during host resumeOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: netlink hash leaks network namespace address to unprivileged readersRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: hisi_femac driver crashes on probe with NULL netdev_opsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: hip04 Ethernet driver crashes at probe with shaper enabledInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDLinux kernel: Actions Owl Ethernet driver crashes on probe with shaper enabledInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: mv643xx Ethernet driver crashes on probe with shaper enabledRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: au1000 Ethernet driver probe crashes with NULL dereferenceRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: ethoc driver crashes on probe with NULL pointer dereferenceRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Aeroflex Ethernet driver crashes on probe with shaper enabledInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: TI PRU Ethernet driver crashes on probe with shaper enabledPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel bcmgenet: shared skb stalls transmit queue until watchdog resetInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: CALIPSO labeling corrupts IPv6 payload length on BIG TCP packetsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel GPIO: memory leak on error path in array value settingInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel GPIO driver: interrupt race during probe can crash the kernelOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: stmmac RGMII status interrupt storm can lock up resumePackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel perf: PMU migration leaves events behind during CPU hotplugInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel: segment override bug lets any user hang CPUsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel FireWire: race condition causes use-after-free in transactionsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Rockchip NPU driver overruns core array on unbind and rebindInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Rocket NPU driver null pointer dereference when unbinding a coreRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: SOF audio topology shift error on aggregated mono captureInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux autofs: stale pipe write error can wrongly freeze mountsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: casefolded filesystem lookups can read a freed Unicode mapInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: watch queue race lets unprivileged user crash the systemRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux KVM guest kernel can panic from async page fault during NMIInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel KVM SEV: page dirtying without a lock during guest populateInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux KVM nested VMX: failed L2 state load leaves NULL pointer dereference crashRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: fsnotify mark race lets an unprivileged fdinfo read crashRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux ext4: freed mount state can be read during symlink lookup, crashing kernelOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel tracefs: use-after-free in eventfs revalidation during dentry releaseOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: failed IPC namespace setup leaks the mqueue mountRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel ntfs3: use-after-free in filename lookup after unmountOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: locked mount namespace file lets a local user unmask filesRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: futex wakeups can reach the wrong process memoryRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: mshv_vtl mmap path can dereference a NULL register pageRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: traffic-control action refcount race frees memory still in useInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: RDS listener on iWARP device crashes the kernel on connectRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel SCTP: stream removed during connect wait causes NULL dereferenceRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: i.MX SPI DMA buffers undersized, corrupting slab memoryOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: tracing histograms let a scalar be read as a stack pointerOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel GPIO shared-proxy use-after-free could corrupt memoryInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: VIA/WMT I2C driver leaks a clock reference on probeInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: reading ring-buffer metadata for offline CPU crashesInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: persistent ring buffer index error can crash trace mappingRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: false warning in ring buffer mmap reader under loadRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: UFS RPMB reply buffer too small, heap write overflowInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel SCSI tape driver: use-after-free when opening a removed tapeRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux Xen SCSI frontend crashes guest on unpopulated backend responseOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel iSCSI: negative task index lets a target read out of boundsPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: iSCSI Reject PDU can complete arbitrary tasksInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel iSCSI: unsolicited target response crashes the host with a null dereferenceInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel AMD display driver: NULL sink pointer dereference crashes systemRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux amdgpu: debugfs GPR read drops runtime PM reference twiceRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: AMD GPU userptr ioctl leaks memory objects on allocation failureInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux amdgpu: closing one BO handle drops eviction fence, user queues unsuspendedOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: DRM exec lock handling can corrupt memory via fence slotsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: missing bounds check on i915 DMC firmware load addressRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Intel Xe GPU driver shrinker accounting underflows on purgeable changeRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: sched_ext use-after-free of destroyed user queueRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: tracing predicate parser can write past its allocationRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel tracing: operator stack overflow when parsing predicatesInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: tracing switch can crash the kernel via NULL pointerRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: tracing histogram timestamp race triggers kernel warningRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: TCP congestion control name read can use freed memoryInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: TCP getsockopt use-after-free with BPF congestion controlRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel CIFS: truncate can leave a wrong file size on failed openRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel dm-crypt: race can report failed I/O as successfulRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel dm-integrity: discard with large tags loops foreverInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: mac802154 association race can cause a NULL dereferenceRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: IUCV recvmsg window update crashes z/VM socketsOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux XFS: buffer lock held across sync commit can deadlock the kernelInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel XFS: capability check lets users bypass group quota limitsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring exit can spin a CPU and panic with panic_on_warnRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: SELinux BPF token checks could be bypassed by swapping file descriptorsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel SCTP: zero-length chunk lock-up lets a remote peer hang the hostInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel: page_pool misalignment can panic x86 via split lockPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel s390 CTCM driver crashes on NULL XID pointerInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel s390 PAI perf: double PMU stop call corrupts sampling stateInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux s390 PCI: short error report write leaks uninitialized kernel memoryInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel: virtio vsock accepts packets from unrelated sourcesRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: VMware VMCI socket accepts packets from wrong peerRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: IPv4 route rebalance can divide by zero and crashInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux KVM on AMD: unexpected shadow-stack bit crashes host kernel with out-of-bounds accessInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel AMD GPU driver: user queue buffer validation flaw on evictionInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel i915: DMC firmware parsing hardened against malformed payload sizesInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel bridge multicast: port group teardown can use freed memoryRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel PSP: use-after-free when accepted sockets inherit Rx associationPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel ksmbd: SMB compound request can leak stale kernel memoryRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel ksmbd: uninitialized memory returned in SMB filesystem control infoRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux ksmbd: stale kernel memory leaks in compound SMB filesystem info repliesRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: flower tunnel-option mask parsing reads past its bufferRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel SMB client: concurrent writes during O_TRUNC silently lose dataRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: CIFS ACL write overflows heap buffer on oversized ACLsRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel SMB client: SetEA writes past request buffer, unprivileged setxattrPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel NTFS: FITRIM discards allocated clusters past free extentRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel NTFS driver: wrong MFT record pointer corrupts attribute resizingInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux amdgpu driver leaks memory when command submission failsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: sched_ext task can sit queued and stall a CPURuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: sched_ext bypass dispatch claim leaks, stalling sub-scheduler tasksRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: workqueue use-after-free can crash or corrupt memoryOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel NTFS driver: size change races page faults, causing spurious SIGBUSInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel NTFS: attribute move corrupts mapping pairs when compression togglesRuntime2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Acronis Cyber Protect 17: missing certificate checks expose sensitive dataOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.9Acronis Cyber Protect 17: token validation flaw leaks sensitive informationInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Acronis Cyber Protect 17 Linux binaries ship with executable stackVendor2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.4Acronis Cyber Protect 17: improper token validation exposes sensitive dataOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.4Acronis Cyber Protect 17: improper token validation leaks and alters sensitive dataOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.2Acronis Cyber Protect 17: improper token validation leaks sensitive informationOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOW3.6Acronis Cyber Protect 17 Linux: missing binary hardening weakens protectionsPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.7Acronis Cyber Protect 17: cross-site scripting via improper input validationVendor2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOW3.1Acronis Cyber Protect 17: improper authorization leaks sensitive informationOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Acronis Cyber Protect 17: insufficiently protected credentials expose sensitive informationOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH8.8Dell PowerProtect Data Domain: stack overflow lets low-privilege remote users gain accessInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.6Dell PowerProtect Data Domain: out-of-bounds write lets low-privileged users crash serviceInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.3Norton, Avast and AVG: Data Shredder link flaw gives SYSTEM rightsVendor2026-10-28 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117858 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117857 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117856 was reserved in error and never a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117855 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117854 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117853 rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117852 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117851 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117850 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117849 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117848 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117847 was reserved in error and withdrawn, no flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117846 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117845 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117844 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117843 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117842 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117841 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117840 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117839 was reserved in error and is not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117838 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117837 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117836 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117835 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117834 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117833 was reserved in error and withdrawn, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117832 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117831 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117830 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117829 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117828 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117827 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117826 was rejected as reserved in error, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117825 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117824 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117823 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117822 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117821 was reserved in error and is not a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117820 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117819 rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117818 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117817 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117816 was reserved in error and rejected, no flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117815 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117814 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117813 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117812 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117811 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117810 was reserved in error and withdrawnOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117809 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117808 was reserved in error and withdrawn, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117807 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117806 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117805 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117804 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117803 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117802 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117801 was reserved in error and rejected, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117800 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117799 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117798 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117797 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117796 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117795 was reserved in error and rejectedOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117794 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117793 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117792 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117791 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117790 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117789 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117788 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117787 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117786 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117785 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117784 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117783 was reserved in error and never a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117782 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117781 was rejected: reserved in error, not a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117780 was reserved in error and is not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117779 was reserved in error and is withdrawnOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117778 was reserved in error and withdrawn, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117777 was rejected; reserved in error, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117776 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117775 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117774 was reserved in error and never a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117773 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117772 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117771 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117770 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117769 was rejected; it never described a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117768 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117767 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117766 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117765 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117764 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117763 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117762 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117761 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117760 was reserved in error and never describes a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117759 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117758 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117757 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117756 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117755 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117754 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117753 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117752 was reserved in error and is not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117751 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117750 was reserved in error and rejected; no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117749 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117748 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117747 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117746 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117745 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117744 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117743 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117742 was reserved in error and never a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117741 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117740 was reserved in error and rejectedOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117739 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117738 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117737 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117736 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117735 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117734 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117733 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117732 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117731 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117730 was withdrawn: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117729 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117728 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117727 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117726 rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117725 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117724 was reserved in error and rejected, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117723 was reserved in error and rejected; no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117722 was reserved in error and never became a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117721 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117720 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117719 was reserved in error and never describes a real vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117718 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117717 was reserved in error and withdrawn, not a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117716 rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117715 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117714 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117713 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117712 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117711 was reserved in error and is withdrawnOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117710 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117709 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117708 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117707 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117706 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117705 was reserved in error and is withdrawnOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117704 was rejected: reserved in error, never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117703 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117702 was reserved in error and never describes a flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117701 was reserved in error and rejected; no flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117700 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117699 was reserved in error and never a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117698 was reserved in error and rejected, no flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117697 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117696 was reserved in error and never describes a real flawOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117695 was rejected; reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117694 was reserved in error and never describes a vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117693 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-117692 was rejected: reserved in error, no vulnerabilityOther2026-10-28 11:17 UTCby NVD–WHAT TO DO MEDIUM4.9WordPress Smart Popup plugin: stored template injection leaks site credentialsPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH8.3NoviGest Desktop App: SAFT import lets crafted XML read local filesPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.4NoviGest Desktop App: unauthenticated Java RMI service leaks credentials and runs OS commandsPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: OS command injection lets a privileged user run commandsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.1Dell PowerProtect Data Domain Management Center: missing authorization allows unauthorized operationsVendor2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Essential Addons for Elementor: email OTP signup skips admin approvalPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Royal Elementor Addons WordPress plugin: form input lets attackers redirect emailPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.6Dell PowerProtect Data Domain Management Center: missing authorization lets low-privileged users actInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.6Dell PowerProtect Data Domain Management Center: SQL injection grants unauthorized access to managed systemsInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Dell PowerProtect Data Domain: stack buffer overflow allows unauthenticated remote command executionInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH8.3Dell PowerProtect Data Domain: improper authentication lets a low-privileged user bypass protectionInfrastructure2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Sadad QA Payment WordPress plugin: forged payment notices mark orders paidPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3BitPay Gateway for WooCommerce: unpaid orders can be marked paidPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM6.9pretix: SSO client can receive id_token despite code-only configurationPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Pretix: gift card IDs let attackers read other organizers' gift card secretsPackage2026-10-28 11:17 UTCby EPSS–WHAT TO DO LOW2.3Product unknown: file shredding protection ignores per-user API token bindingOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO HIGH7.1Acronis Cyber Protect agents: local privilege escalation through improper authenticationOther2026-10-28 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Dell PowerProtect Data Domain: unauthenticated remote request can cause denial of serviceInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: OS command injection lets a privileged user run commandsInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: privileged user can escalate privileges remotelyInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM4.9Dell PowerProtect Data Domain: heap overflow lets a privileged remote user crash serviceInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Dell PowerProtect Data Domain Management Center: authentication bypass allows denial of serviceInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Dell PowerProtect Data Domain: missing authorization lets low-privileged users gain accessInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: integer overflow lets privileged attacker run codeInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Dell PowerProtect Data Domain: path traversal gives unauthenticated remote filesystem accessInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Dell PowerProtect Data Domain Management Center: SQL injection leaks information to low-privilege usersInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH8.8Dell PowerProtect Data Domain: low-privileged user can escalate privileges remotelyInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Dell PowerProtect Data Domain: hard-coded crypto key exposes credentials remotelyInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Dell PowerProtect Data Domain: path traversal leaks information to privileged usersInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: integer overflow lets privileged user bypass protectionInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain Management Center: OS command injection allows command executionInfrastructure2026-10-28 10:17 UTCby EPSS–WHAT TO DO CRITICAL9.1Futurum Software management software: blind SQL injection exposes customer PIIVendor2026-10-28 10:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5HAVELSAN Liman MYS: path traversal flaw in versions before 2.3.5-1132Other2026-10-28 10:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @zmtcdn/components (npm)@zmtcdn/componentsPackage2026-10-28 09:59 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCloudflare: Increased Errors for Durable Objects in the Eastern North America regionCloudflareVendor2026-10-28 09:45 UTCby status page–WHAT TO DO LOW2.7Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged usersInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO LOW2.7Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged usersInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO LOW3.4Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of serviceInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.7Dell PowerProtect Data Domain: integrity check flaw lets admins bypass protectionsInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO LOW2.7Dell PowerProtect Data Domain Management Center: SQL injection leaks information to adminsInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.1Dell PowerProtect Data Domain Management Center: authentication bypass lets low-privilege users escalateInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO LOW2.7Dell PowerProtect Data Domain Management Center: SQL injection exposes stored informationInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Dell PowerProtect Data Domain: unauthenticated remote root command execution via authentication flawInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain: OS command injection lets a privileged user run commandsInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO HIGH8.8Dell PowerProtect Data Domain: path traversal gives attackers filesystem accessInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Dell PowerProtect Data Domain: unauthenticated remote attacker creates privileged accountsInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO HIGH8.8Dell PowerProtect Data Domain: OS command injection lets low-privileged users run commandsInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO HIGH7.2Dell PowerProtect Data Domain Virtual Edition: OS command injection enables command executionInfrastructure2026-10-28 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.4DefterAsist Financial Advisor Platform: stored XSS lets attackers run scriptsOther2026-10-28 09:17 UTCby EPSS–WHAT TO DO HIGH8.8MemberPress WordPress plugin: CSRF lets attackers change user emails, take over accountsPackage2026-10-28 08:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Enable Media Replace WordPress plugin lets authors edit any published postPackage2026-10-28 08:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Escargot JavaScript engine: out-of-bounds write lets attackers manipulate memoryRuntime2026-10-28 08:16 UTCby EPSS–WHAT TO DO MEDIUM6.1Echo Knowledge Base WordPress plugin: unauthenticated script injection via config parameterPackage2026-10-28 08:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @zmtcdn/ui (npm)@zmtcdn/uiPackage2026-10-28 07:27 UTCby osv-malicious–UNINSTALL MEDIUM6.1WordPress Multi-Step Forms for Contact Form 7: reflected XSS via l10n_print_afterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Post Snippets WordPress plugin: contributors can inject stored scripts into pagesPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Waitlist WooCommerce plugin: stored XSS via shortcode attributePackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.3Beyondseo WordPress plugin: Contributors can manage site-wide redirectsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.3PayPal Brasil for WooCommerce: unauthenticated users can change payment gateway settingsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WP Inventory Manager: sort_order shortcode attribute allows SQL injectionPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH7.1AXIS Camera Station Pro: database backups open to offline credential attacks2 talkingVendor2026-10-28 07:16 UTCby EPSS2talkingWHAT TO DO MEDIUM5.3WordPress ACF Extended plugin: unauthenticated AJAX leaks post titles and layoutsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.9Hustle WordPress plugin: stored XSS via CTA label parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4If-So Dynamic Content WordPress plugin: stored XSS via contributor-level editingPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4WordPress CMB2 plugin: stored XSS through wysiwyg group fieldPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5VikRentCar WordPress plugin: blind SQL injection via catid parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4VikRentCar WordPress plugin: stored script injection via className parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Clean Login WordPress plugin lets contributors overwrite login page settingsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WP Visitor Statistics plugin: shortcode attributes enable SQL injection for contributorsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress WoowBot plugin lets subscribers trigger paid AI embedding callsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Travelly WooCommerce plugin: contributors can copy private admin postsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH8.8WordPress VikRentCar plugin: forged admin request writes PHP, enabling server takeoverPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH7.2Prime Slider WordPress plugin: stored XSS via comment parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.4DesignSetGo WordPress plugin: stored XSS through tagName parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH7.2MxChat WordPress plugin: stored XSS via feedback parameter, up to 3.2.25Package2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.9Bit Flows WordPress plugin: unauthenticated file inclusion runs PHP on the serverPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress Mang Board plugin: stored XSS via align parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WordPress Rich Showcase Google Reviews plugin: contributors can steal site auth secretPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.4WooCommerce Product Addons plugin: stored XSS via field type parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Related Posts plugin: contributors can read private post titlesPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Related Posts plugin: contributors can read titles of private postsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Cozy Blocks WordPress plugin: stored XSS via product rating icon colorPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Cozy Blocks WordPress plugin: stored XSS via block attributesPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4s2Member WordPress plugin: contributor can inject stored script via date_formatPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Tour Booking Manager WordPress plugin: stored XSS via hotel map shortcodePackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4UiChemy WordPress plugin: stored XSS via builder link URLPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH8.8PUBLIC EXPLOITWordPress IvyForms plugin: file upload accepts PHP files, enabling code executionPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO HIGH7.2WordPress Mage Eventpress plugin: shop managers can escalate to administratorPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress Document Embedder plugin: stored XSS via embedded document downloadPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress Contact Manager plugin: unauthenticated arbitrary file upload via add_messagePackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4easy.jobs WordPress plugin: contributor can inject scripts via job-list blockPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Hustle WordPress plugin: stored XSS via content title parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM4.9Tainacan WordPress plugin: directory traversal lets editors read server filesPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4If-So Dynamic Content WordPress plugin: stored script injection via shortcodePackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Avada Fusion Builder WordPress plugin: stored XSS via shortcode attributesPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4If-So Dynamic Content WordPress plugin: stored XSS via url parameterPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Awesome Support WordPress plugin: stored XSS via ticket file uploaderPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MEDIUM5.4Postie WordPress plugin: unauthenticated email input stores cross-site scripting payloadsPackage2026-10-28 07:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in identity-two-factor (npm)identity-two-factorPackage2026-10-28 06:56 UTCby osv-malicious–UNINSTALL HIGH7.5WordPress Lumise plugin: unauthenticated attackers read arbitrary server filesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDRecipe Card Blocks Lite WordPress plugin: SQL injection via block attributesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWP Roster WordPress plugin: unauthenticated users can delete roster member accountsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCustomer Engagement System WordPress plugin: unauthenticated internal network probing via MailChimp lookupPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCustomer Engagement System WordPress plugin: admin SQL injection reads the databasePackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDPayPlug WooCommerce plugin lets anyone read, edit and delete ordersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGeoDirectory WordPress plugin leaks draft and private listings via shortcodesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGeoDirectory WordPress plugin: post badge shortcode enables stored cross-site scriptingPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGeoDirectory WordPress plugin: stored XSS via post badge linkPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress Media Library Assistant: forged request empties media trashPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDMedia Library Assistant WordPress plugin: forged requests can delete attachmentsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress MP3 Audio Player plugin: shortcode attribute lets contributors run scriptsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDRoyal MCP WordPress plugin lets contributors copy and publish private pagesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDRoyal MCP WordPress plugin: search tool leaks non-public post content to subscribersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDGoSMTP WordPress plugin: low-role users can change mail settings and take over adminPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWelcart e-Commerce WordPress plugin lets authors alter other products' SKUsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWelcart e-Commerce WordPress plugin: unvalidated redirect to external sitesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWelcart e-Commerce WordPress plugin: SQL injection by Editor-role usersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPersian WooCommerce SMS WordPress plugin: reflected XSS runs in admin sessionsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWPOrLogin WordPress plugin lets anyone change login URL slugsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress Copy Anything to Clipboard plugin: shortcode stored XSS for contributorsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDEssential Addons for Elementor: unauthenticated visitors can read private post fieldsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDSiteOrigin Page Builder: contributors can read other users' draft and private postsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDWordPress Page Builder plugin: stored XSS via widget property before 2.38.0Package2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPayPlug WooCommerce plugin lets anyone cancel other customers' unpaid ordersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.8WordPress WooCommerce email verification plugin lets attackers log in unauthenticatedPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDRoyal Addons for Elementor: unauthenticated users can read non-public post contentPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDRoyal Addons for Elementor: map widget size setting enables stored cross-site scriptingPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDRoyal Addons for Elementor: missing authorization lets anyone add Mailchimp subscribersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDRoyal Addons for Elementor: contact form mail redirected by Author-role usersPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCourt Reservation WordPress plugin: unauthenticated users can change reservation typesPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCourt Reservation WordPress plugin lets anyone delete challenge and booking recordsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDBooking Package WordPress plugin lets anyone trigger verification emailsPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDMenu Cart for WooCommerce: stored XSS via cart variation dataPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDThrive Automator WordPress plugin: editor users can run blind SQL injectionPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDPUBLIC EXPLOITCheckout Files Upload for WooCommerce: unauthenticated file upload leads to code executionPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDCasso Flow WordPress plugin: forged payment notices mark WooCommerce orders paidPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDPayconiq WordPress plugin: unauthenticated users can view any paid orderPackage2026-10-28 06:16 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDUniPAY WooCommerce plugin: forged payment notices mark unpaid orders as paidunipay-payment-gateway-for-woocommercePackage2026-10-28 06:16 UTCby InfraStack Analyst–FIX 2.4 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in spectral-net-probe (npm)spectral-net-probePackage2026-10-28 05:37 UTCby osv-malicious–UNINSTALL LOWINCIDENTTwilio: Twilio Console ErrorsTwilioVendor2026-10-28 05:30 UTCby status page–WHAT TO DO MEDIUM5.3Google ADK: shared file artifact root lets apps read each other's artifactsAI agents & MCP2026-10-28 05:16 UTCby EPSS–WHAT TO DO HIGH8.7EagleCloud Aquila: unauthenticated attackers reach access keys and deployment secretsInfrastructure2026-10-28 05:16 UTCby EPSS–WHAT TO DO CRITICAL9.4EagleCloud Aquila Pigeon MFA service: code injection lets authenticated attackers run codeOther2026-10-28 05:16 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTCloudflare: Network Performance Issues in Ashburn, IADCloudflareVendor2026-10-28 04:39 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel p54 Wi-Fi driver: firmware parser reads past record boundsRuntime2026-10-28 04:18 UTCby EPSS–WHAT TO DO HIGH8.8Rank Math SEO WordPress plugin: contributor users can inject PHP objectsPackage2026-10-28 04:18 UTCby EPSS–WHAT TO DO MEDIUM4.0a2ui web renderer expression parser lets remote input exhaust resourcesPackage2026-10-28 04:18 UTCby EPSS–WHAT TO DO MEDIUM5.5a2ui: resolveSignal flaw lets remote requests consume excessive resourcesPackage2026-10-28 04:17 UTCby EPSS–WHAT TO DO HIGH7.5WordPress Animated Text Block plugin: shortcode leaks hidden post contentPackage2026-10-28 04:17 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress Appointment Booking Calendar plugin: stored XSS via vs_text_submitbtnPackage2026-10-28 04:17 UTCby EPSS–WHAT TO DO HIGH7.5WordPress affiliate-toolkit plugin: file upload lets contributors run codePackage2026-10-28 04:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTAnthropic: Elevated errors affecting the Gmail connectorAnthropicVendor2026-10-28 03:59 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Degraded Performace on ChatGPT WorkOpenAIVendor2026-10-28 03:39 UTCby status page–WHAT TO DO HIGH7.2AMP for WP plugin: stored XSS via headline shortcode attributePackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress Pie Register Premium: unauthenticated file upload leads to remote code executionPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.1GNU mtools: out-of-bounds write in FAT parsing may corrupt memoryOther2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.5Tabularis: SQLite describe_table MCP tool allows stacked SQL statementsAI agents & MCP2026-10-13 08:00 UTCby EPSS–WHAT TO DO HIGH8.7mews/pos: forged payment callbacks let attackers complete unpaid ordersPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.0WeKnora: NAT64 IPv6 addresses bypass internal-address filter, enabling SSRFAI agents & MCP2026-10-28 03:17 UTCby EPSS–WHAT TO DO CRITICAL9.2llama.cpp RPC server: unauthenticated stack overflow via RDMA transportAI agents & MCP2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.2LibreSSL ocspcheck: unbounded OCSP HTTP responses exhaust memoryInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.3LibreSSL ocspcheck sends OCSP requests in cleartext on non-443 portsInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.3LibreSSL ocspcheck: CRLF in certificate OCSP URI injects HTTP headersInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.3LibreSSL: OCSP request path lets certificate URIs inject HTTP headersInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.2libexpat: attribute count overflow lets crafted XML corrupt heap memoryPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.3a2ui: binder flaw in web renderer lets remote input exhaust resourcesPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.3a2ui: DataModel.set flaw lets remote input exhaust resourcesPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.2libexpat: crafted XML chunking crashes parser via NULL pointer dereferencelibexpatPackage2026-10-28 03:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1rtl_433: stack overflow in Proflame decoder lets nearby radio attacker corrupt memoryOther2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Assimp: crafted MD2 file overflows header check, leaks or crashes heapPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.6Xerte Online Toolkits: crafted language pack import runs PHP on serverPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM5.4NexoPOS: cashiers can alter other cashiers' register sessions and balancesPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM5.3nopCommerce: vendors can add products to other vendors' listingsPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.9GROWI: missing authorization lets read-only users modify page draftsPackage2026-10-27 05:18 UTCby EPSS–WHAT TO DO HIGH7.2WordPress affiliate-toolkit plugin: stored XSS via product URL parameterPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH7.2WordPress AI Marketing Expert plugin: stored XSS via chatbot name parameterPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress video gallery plugin: stored XSS via more_link parameterPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.2GROWI: tag and page update APIs let logged-in users read and write restricted pagesPackage2026-10-27 05:18 UTCby EPSS–WHAT TO DO MEDIUM6.4WordPress video gallery plugin: subscribers can inject stored scriptsPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.2AI Engine WordPress plugin: subscribers can delete arbitrary media filesOther2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Ultimate Member WordPress plugin: stored XSS via profile website URLPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.2GROWI: authenticated users can read restricted pages and commentsPackage2026-10-27 05:18 UTCby EPSS–WHAT TO DO HIGH8.8CrushFTP: CSRF lets a lured admin create root usersPackage2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.8qEngine CMS, Kemana Directory, Cart Engine: editors can upload PHP and run codeOther2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH7.1qEngine, Kemana Directory and Cart Engine: admin file inclusion reads server filesqEngine CMSOther2026-10-28 03:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.2C97net qEngine, Kemana Directory, Cart Engine: exposed database backups leak admin hashesOther2026-10-28 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Linksys WAG200G router: stored XSS via policy_name runs in admin browsersInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH7.0Linksys WAG200G router: admin password changeable without current passwordInfrastructure2026-10-28 03:17 UTCby EPSS–WHAT TO DO HIGH8.6Linksys WAG200G router: authenticated command injection gives full device controlWAG200GInfrastructure2026-10-28 03:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3a2ui web renderer error messages expose internal information remotelyPackage2026-10-28 02:17 UTCby EPSS–WHAT TO DO MEDIUM4.3a2ui: data-context resolver flaw lets remote requests exhaust resourcesPackage2026-10-28 02:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Jupiter X Core WordPress plugin: Twitter login lets anyone sign in as adminPackage2026-10-28 02:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in glyphmatrix-fixture (npm)glyphmatrix-fixturePackage2026-10-28 02:16 UTCby osv-malicious–UNINSTALL CRITICAL9.8jackson-databind: generic type IDs bypass class validation, enabling remote code executionPackage2026-06-16 01:10 UTCby EPSS–WHAT TO DO HIGH7.5Jackson protobuf parser: 8-byte message crashes JVM with OutOfMemoryErrorPackage2026-10-20 22:45 UTCby EPSS–WHAT TO DO LOWINCIDENTTwilio: Elevated 500 Errors Affecting Programmable Voice APITwilioVendor2026-10-28 00:58 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Increased Errors for Durable Objects in the Eastern North America regionCloudflareVendor2026-10-28 00:17 UTCby status page–WHAT TO DO HIGH7.5Chitchatter: postMessage config check lets attackers bypass authentication remotelyOther2026-10-28 00:17 UTCby EPSS–WHAT TO DO HIGH7.5Jackson Smile parser: crafted input forces huge allocation, crashes async endpointsPackage2026-10-20 22:47 UTCby EPSS–WHAT TO DO HIGH7.5Jackson protobuf module: crafted length field triggers out-of-memory crashPackage2026-10-20 22:46 UTCby EPSS–WHAT TO DO CRITICALCAMPAIGNEXPLOITEDAttackers try GitLab CI regex RCE (CVE-2026-97229) on self-hosted GitLab; upgrading GitLab does not fix installs that use their own RubyGitLab10 talkingInfrastructure2026-10-28by InfraStack Analyst10talkingFIX 3.3.13 HIGHTECHNIQUEmacOS git, curl and python3 still trust the compromised eMudhra CAs, and macOS 27.2 undoes the manual fixmacOS4 talkingRuntime2026-10-28by InfraStack Analyst4talkingWHAT TO DO HIGHNOT SCOREDCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsAI agents & MCP2026-10-28by Vendor & lab pages–WHAT TO DO HIGH6.5Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6…AI agents & MCP2026-10-28by EPSS–WHAT TO DO HIGHCAMPAIGNDON'T CLICKPhishing tricks users into enrolling their PCs in attacker-controlled Hexnode or Rippling MDM, which then keeps reinstalling ScreenConnect for remote accessHexnode UEM1 talkingVendor2026-10-28by InfraStack Analyst1talkingWHAT TO DO HIGH5.9Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler)…Package2026-10-28by EPSS–WHAT TO DO MEDIUMNOT SCOREDCVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandasPackage2026-10-28by Vendor & lab pages–WHAT TO DO HIGHCAMPAIGNEXPLOITEDKeyDriftSilent TrainVolt Typhoon's 'Silent Train' hides attacks, including zero-days on SD-WAN and IT management platforms, behind short-lived chains of hacked routers and IoT devicesVeloCloud Orchestrator3 talkingInfrastructure2026-10-28by InfraStack Analyst3talkingWHAT TO DO MEDIUMCAMPAIGNDATA EXPOSEDAmadeus airline passenger service system breached: JAL says booking records of about 92,000 people, including about 2,000 passports, were viewedAmadeus2 talkingVendor2026-10-28by InfraStack Analyst2talkingWHAT TO DO HIGHTECHNIQUESteam Windows client bugs with public exploit code let a local user become SYSTEM, and a connected Steam peer can run code (Atredis 'Turning the Valve')SteamVendor2026-10-28by InfraStack Analyst–WHAT TO DO

Tuesday, Oct 27Wednesday, Oct 28Thursday, Oct 29