Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 564 threats · Monday, Nov 2· last check 2026-11-04 06:10 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Monday, Nov 2

Most severe in everything

SUPPLY CHAINNO CVE YET

EXPLOITED IN THE WILD

cPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)cPGuard2 talking

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Attackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot walletsBTCPay Server

BREACHNO CVE YET

Mercado Bitcoin, Brazil's largest crypto exchange, breached: about $46M drained from its wallets, deposits and withdrawals haltedMercado Bitcoin

SUPPLY CHAINNO CVE YET

EXPLOITED IN THE WILD

Android TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)Videostrong Android TV set-top boxes

Monday, Nov 2

CRITICALCAMPAIGNEXPLOITEDcPGuard breachOPSSHIELD breachcPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)cPGuard2 talkingVendor2026-11-02 20:14 UTCby InfraStack Analyst2talkingFIX 5.88.25 MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio to Claro Puerto RicoTwilioVendor2026-11-02 23:38 UTCby status page–WHAT TO DO HIGH8.7Johnson Controls EasyIO building controllers: authentication bypass through alternate pathEasyIO Neo ECInfrastructure2026-11-02 23:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7PyMuPDF: callout points overflow stack, letting crafted input run codePackage2026-11-02 23:17 UTCby EPSS–WHAT TO DO MEDIUM5.0Welcart e-Commerce plugin: payment error page allows cross-site scriptingPackage2026-11-02 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111565 was rejected and withdrawn by its numbering authorityOther2026-11-02 23:17 UTCby NVD–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDMercado Bitcoin, Brazil's largest crypto exchange, breached: about $46M drained from its wallets, deposits and withdrawals haltedMercado BitcoinVendor2026-11-02 20:19 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITs2Member WordPress plugin up to 260927: item_name parameter allows PHP code executions2memberPackage2026-11-02 22:17 UTCby InfraStack Analyst–FIX 261001 LOW2.0hivex: crafted registry hive file causes out-of-bounds read and crashPackage2026-11-02 22:17 UTCby EPSS–WHAT TO DO HIGH8.7Temporal Server: a read-only namespace caller can run commands on the hostRuntime2026-11-02 22:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless…AI agents & MCP2026-11-02 21:34 UTCby EPSS–WHAT TO DO HIGH8.2Eclipse ThreadX NetX Duo: IPv6 raw send NULL pointer crashnetxduoRuntime2026-11-01 17:32 UTCby InfraStack Analyst–FIX 6.5.2.202603b HIGH8.7Eclipse ThreadX NetX Duo: DTLS server session pool exhaustion denies servicenetxduoInfrastructure2026-11-01 17:32 UTCby InfraStack Analyst–FIX 6.5.2.202603b MEDIUMINCIDENTCloudflare: Cloudflare Gateway DNS-over-TLS Connectivity Issues over IPv4CloudflareVendor2026-11-02 22:12 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pyprig (PyPI)pyprigPackage2026-11-02 22:11 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerAI agents & MCP2026-11-02 21:43 UTCby Vendor & lab pages–WHAT TO DO MEDIUMINCIDENTSupabase: Storage uploads failing in us-east-1SupabaseVendor2026-11-02 21:34 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Receipt Delays from a Subset of Twilio Short Codes to Liberty Puerto RicoTwilioVendor2026-11-02 21:21 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDAndroid timed cache header check allows out-of-bounds write, local privilege escalationInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid SystemUI: spoofed Quick Controls panel lets apps launch activitiesInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid EVS camera HAL: data race lets privileged app run codeRuntime2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid EVS HAL: race lets a privileged client free a buffer in useInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid automotive EVS HAL: concurrent calls cause use-after-free, enabling code executionInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid EVS HAL: heap out-of-bounds read leaks memory via camera metadataInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Automotive: passenger display leaks private notifications and runs actions unlockedRuntime2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check lets an app bypass drag-and-drop restrictionsInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Automotive: unprivileged apps can show content on instrument cluster displayInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDAndroid: a dump method lets a privileged app write secure display settingsInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO HIGH8.8ReadyMedia: crafted DFF audio file overflows stack, enabling remote code executionreadymediaPackage2026-11-02 21:17 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDINFINITT PACS: local users can run commands as administrator via update manifestINFINITT PACS System ManagerOther2026-11-02 21:17 UTCby InfraStack Analyst–FIX 3.0.12.3 LOW3.3GeekezBrowser: public API status endpoint leaks information to local usersPackage2026-11-02 21:17 UTCby EPSS–WHAT TO DO MEDIUM6.7konflux-ci: unquoted shell variables let local users run commandsInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO HIGH7.1Secure Access servers: missing length check lets logged-in users cause lasting outageInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO HIGH7.1Secure Access servers: improper input handling lets logged-in users cause lasting outageInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO HIGH8.3Secure Access server: improper input handling enables persistent denial of serviceInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDcPanel: link resolution flaw lets a logged-in user write root-owned filesInfrastructure2026-11-02 21:17 UTCby EPSS–WHAT TO DO HIGH8.7cPanel & WHM: anyone with no account can read any mail account's calendar and contactscPanel & WHMInfrastructure2026-11-02 21:17 UTCby InfraStack Analyst–FIX 134.0.67 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ifasn/mmd-doc-mcp (npm)@ifasn/mmd-doc-mcpPackage2026-11-02 20:59 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ifasn/md-doc-mcp (npm)@ifasn/md-doc-mcpPackage2026-11-02 20:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ifasn/mmdd-doc-mcp (npm)@ifasn/mmdd-doc-mcpPackage2026-11-02 20:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @ifasn/mdd-doc-mcp (npm)@ifasn/mdd-doc-mcpPackage2026-11-02 20:58 UTCby osv-malicious–UNINSTALL LOWINCIDENTTwilio: Voice Call One-Way Audio from Brazil to a Subset of Twilio NumbersTwilioVendor2026-11-02 20:55 UTCby status page–WHAT TO DO CRITICAL9.4Secure Access server: forged requests let an attacker create admin accountsSecure Access serverInfrastructure2026-11-02 20:18 UTCby InfraStack Analyst–FIX 14.61 LOW3.5Dell Alienware Command Center: custom URL handler lets low-privilege users forge requestsOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Dell Alienware Command Center: custom URL handler lets remote attackers run commandsOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO MEDIUM6.4Dell Alienware Command Center: unsigned update code can run with elevated rightsVendor2026-11-02 20:18 UTCby EPSS–WHAT TO DO HIGH8.1Dell Alienware Command Center: unsigned updates let nearby attackers run codeOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO MEDIUM6.4Dell Alienware Command Center: improper certificate checks allow code execution locallyOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO LOW3.9Dell Alienware Command Center: local authentication bypass by spoofing, low privilegeVendor2026-11-02 20:18 UTCby EPSS–WHAT TO DO HIGH7.1Dell Alienware Command Center: incorrect default permissions allow local information tamperingOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO MEDIUM6.7Dell Alienware Command Center: low-privilege local user can escalate privilegesOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO HIGH7.8Dell Alienware Command Center: local users can gain elevated privilegesOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO MEDIUM4.2Dell Alienware Command Center: input validation flaw allows local denial of serviceOther2026-11-02 20:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux trace code: out-of-bounds read leaks kernel memory to local usersOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: logic error allows local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux pKVM: out-of-bounds write in guest memory relinquish pathInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: race condition corrupts memory, allowing local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: use-after-free logic error allows local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: race in ARM page table unmap causes memory corruptionInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel pKVM: race condition allows out-of-bounds write, local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid input dispatcher logic error allows local denial of serviceInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: confused deputy in AID conflict handling allows permission bypassInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid MediaProvider: logic error lets apps bypass permissions and read dataRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: input validation flaw allows local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: race condition in user data removal allows local denial of serviceRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDProfilingService.java: path traversal in sendAnomalyProfile enables local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: permission bypass via confused deputy leaks local dataOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed Android-style component: integer overflow enables local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check lets an app read last known cell IDInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid-style permission bypass lets local apps read information without privilegesOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDRust legacy.rs deserializer: missing bounds check allows local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: setApplicationRestrictions flaw lets a local app cause denial of serviceInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCodebook decoder out-of-bounds read could leak memory remotelyOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: window touch occlusion check lets overlay apps tapjack usersRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid MMS provider lets one user access another user's messagesOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: uncaught exception lets local users bypass permissionsOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check in subscription manager leaks local informationRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: USB device manager flaw lets someone bypass the lock screenOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: telephony provider permission check lets a local app read dataInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: permission bypass via confused deputy allows local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Bitmap.cpp: out-of-bounds read leaks information locallyOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: heap overflow in ZIP entry parsing allows local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid NFC service: missing permission check allows local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Bluetooth L2CAP: integer overflow lets remote attackers read memoryInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check lets a local app bypass FRP lockRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid-style ShimConverter isValid flaw allows local out-of-bounds readOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check in media quality service allows privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid RpcServerTrusty: logic error lets local process cause denial of serviceInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed component: use-after-free lets local code escalate privilegesOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: permission bypass in PresentationController lets local apps escalate privilegeInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: logic error lets a permission check be bypassedOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid ProviderUtil: logic error leaks data across user accountsOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMissing bounds check allows out-of-bounds write and local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check lets local apps escalate privilegesOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMuPDF print driver: integer overflow allows out-of-bounds memory readOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: AppTimeTracker confused deputy lets an app launch in backgroundInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid MediaQualityService: missing permission check lets apps read data locallyRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDOAPV codec: double free in metadata parsing lets remote attackers corrupt memoryPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDhppsfilter.c: stack buffer overflow lets a local user gain higher privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid MusicFxHelper: confused deputy lets a local app bypass permissionsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: SMS usage monitor input check lets an app bypass permissionsRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnknown product: input validation flaw allows remote denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAndroid: missing permission check lets a local app escalate privilegesandroidRuntime2026-11-02 20:17 UTCby InfraStack Analyst–FIX security patch level 2026-11-05 NOT SCOREDNOT SCOREDAndroid: background activity launch in task manager lets apps escalate privileges locallyInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAndroid: background activity launch flaw allows local privilege escalationandroidInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–FIX 2026-11-01 security patch level NOT SCOREDNOT SCOREDAndroid verified boot: RSA signature check can be bypassed locallyInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: notification channel update logic lets a local app obscure UIOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDoapv_vlc.c decoder: heap overflow lets remote input read out-of-bounds memoryPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMissing permission check lets local apps read information they should notOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: stack buffer overflow in metadata parser allows remote denial of serviceInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: logic error in activity navigation lets apps bypass permissionsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnknown product: side-channel flaw leaks paired device information via crypto misuseOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: background app launch flaw lets an app escalate privileges locallyInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: confused deputy in AddAccountSettings enables local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: memory fault handling flaw lets local users gain rootInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid MPEG4 parser: crafted media file can cause denial of serviceRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: input validation flaw allows persistent local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDlibpng: use-after-free in png_set_tRNS allows remote code executionPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: window relayout logic error allows local permission bypassInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDC2SoftApvDec decoder: out-of-bounds read leaks remote informationPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: tapjacking flaw in input window handling lets an app escalate privilegesRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnidentified product: permission bypass via confused deputy enables local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid WifiServiceImpl: confused deputy lets an app bypass permission checksInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: logic error allows remote denial of service, no loginOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDSMS of DeathAndroid "SMS of Death": one malformed WAP Push text crashes the phone service and drops calls, including emergency callsandroid4 talkingRuntime2026-10-30by InfraStack Analyst4talkingFIX security patch level 2026-11-01 (Android 14, 15, 16, 16-qpr2, 17)NOT SCOREDNOT SCOREDDescramble of multiple files allows out-of-bounds write, local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: Wi-Fi Direct permission check lets apps read nearby device dataInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMemory-safety use-after-free flaw in unnamed product allows remote code executionOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed product: improper input validation allows local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: heap overflow in WiFi interface code allows local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: Wi-Fi Direct permission check missing, leaks local informationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDHeap buffer overflow in FrameDecoder lets remote code runOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check in Wi-Fi Direct service lets apps escalate privilegeInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: accessibility window code lacks a permission check, enabling local privilege escalationRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid crypto HAL: use-after-free race lets remote code runInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDipphelper.c: stack buffer overflow from missing bounds check, remote crashOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAndroid kernel: double free in KVM VFIO pviommu attach error path allows local privilege escalationAndroid kernelInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–FIX security patch level 2026-11-05 NOT SCOREDNOT SCOREDUnknown product: out-of-bounds write from integer overflow allows local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDOut-of-bounds read and write lets local users escalate privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDHelpers.java input validation flaw lets local code read informationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed Android-style component: logic error lets background activity launch, escalating privilege locallyOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAndroid: sideloaded app can bypass Enhanced Confirmation Mode during self-updateAndroidRuntime2026-11-02 20:17 UTCby InfraStack Analyst–FIX security patch level 2026-11-05 NOT SCOREDNOT SCOREDLinux FUSE: use-after-free in backing mmap lets local users escalate privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnknown component: base.c use-after-free race lets local users escalate privilegeInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDAndroid kernel dma-buf race condition allows use-after-free and local privilege escalation (fixed in 2026-11-05 patch level)AndroidInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–FIX 2026-11-05 NOT SCOREDNOT SCOREDLinux kernel: unshare use-after-free lets local user escalate privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel fork.c: use-after-free lets a local user gain higher privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel pKVM tracing: out-of-bounds write lets local user gain privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid search database utility: SQL injection exposes protected data locallyOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: certificate parsing flaw allows permanent local denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: integer overflow in MMS PDU parser allows remote denial of serviceRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Bluetooth: integer underflow in rw_ci_data_cback leaks remote dataInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: confused deputy lets an app dial sensitive USSD codes locallyInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid telephony: SIM record parsing flaw allows local denial of serviceInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: misleading permission screen tricks users into granting account credentialsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnknown product: use-after-free lets remote attackers escalate privilegeOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUse-after-free race condition allows remote privilege escalation without user interactionOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnnamed component: resource exhaustion lets local process bypass permissionsOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid Contacts Picker: intent redirection lets an app gain local privilegesRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid DownloadProvider: confused deputy lets local apps read informationRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: misleading widget consent screen allows local privilege escalationInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: notification listener permission flaw lets a local app escalate privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid NFC stack: missing permission check allows local code executionInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid USB dialog helper: misleading UI lets a local app escalate privilegeRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: locale manager flaw lets an app read another user's locale fileRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid telephony: USSD/MMI input validation lets local apps escalate privilegeInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: contacts from protected profile leak through confused deputyInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid launcher: unauthorized shortcuts can crash the home screenInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: account manager UI flaw lets a local app escalate privilegeRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid telecom service: permission bypass lets a local app escalate privilegesInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: media can show after being disabled in carousel controllerRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: SaveUi logic error lets local apps bypass package installation requirementsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: cross-profile consent dialog label injection allows local privilege escalationOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: USB data enabled without authentication after strong auth changeInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMissing permission check lets local process cause denial of serviceOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDUnidentified app: a logic error lets files be shared across profilesOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: missing permission check lets apps read ringtone dataInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: URI grant handling lets a local app bypass permissionsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGH8.4Android: ExternalStorageProvider logic error exposes protected files to local appsAndroidRuntime2026-11-02 20:17 UTCby InfraStack Analyst–FIX security patch level 2026-11-05 MEDIUM4.3HDF5: crafted file triggers unbounded recursion and crashes the readerPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGH7.0Nexbox A95X TV box: physical UART header gives unauthenticated root shellNexbox A95XInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9Nexbox A95X TV boxes: VobSub subtitle decoder memory corruption flawVendor2026-11-02 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Nexbox A95X TV box: VobSub decoder loop lets crafted subtitles freeze playbackInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO HIGH8.5Nexbox A95X TV boxes: local root via pppoe_wrapper socket injectionNexbox A95XInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDSercomm AOT-4221SR router: UPnP flaw lets attackers change admin settings without loginAOT-4221SRInfrastructure2026-11-02 20:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.3Secure Access servers: authentication bypass lets attackers change client security settingsInfrastructure2026-11-02 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.8WordPress Ultra Addons for Contact Form 7: unauthenticated arbitrary file deletion leads to code executionPackage2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: a primary user can disable NFC for other usersRuntime2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: overlay tricks a user into granting a permission, local privilege gainOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid: tapjacking overlay tricks user into leaking Autofill contentsOther2026-11-02 20:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDCVE-2026-120497 Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsPackage2026-11-02 19:43 UTCby Vendor & lab pages–WHAT TO DO HIGH7.7Grafana Mimir: Alertmanager tenants can read arbitrary files from the hostInfrastructure2026-11-02 19:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-67186 was rejected and withdrawn by its numbering authorityOther2026-11-02 19:18 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDOpenKruise kruise-manager: unauthenticated pprof endpoint enables denial of serviceInfrastructure2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.0AWS AI-DLC aidlc-traceability CLI: stored XSS in HTML traceability reportsAI agents & MCP2026-11-02 19:07 UTCby EPSS–WHAT TO DO MEDIUM5.9psqlODBC: stack overflow in updatable cursor ctid handling lets a server write memoryPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.3psqlODBC: default /tmp log files leak queries and enable symlink attacksPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.1psqlODBC: unescaped column names let table creators inject SQLPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.5psqlODBC: unchecked column and row numbers allow out-of-bounds memory writesPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.9psqlODBC: long schema or table name overflows stack buffer by two bytesPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.5psqlODBC: SQLSpecialColumns lets untrusted names run arbitrary SQLPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.5psqlODBC: crafted ODBC escape sequences corrupt memory in client applicationsPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.9psqlODBC: server data can crash the client or read out of boundsPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM6.8psqlODBC: column names with format directives leak client memory into queriesPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.5psqlODBC: a malicious server can overflow driver memory via FETCH repliesPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.5psqlODBC: large-object reads let a server overwrite client memoryPackage2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH8.8Attendo Admin Android app ships MQTT broker credentials, exposing employee dataOther2026-11-02 19:18 UTCby EPSS–WHAT TO DO MEDIUM5.4Munshi by Petpooja: stored script injection in purchase inquiry threadsOther2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH7.1Munshi (Petpooja): authenticated users can read other users' supplier inquiriesOther2026-11-02 19:18 UTCby EPSS–WHAT TO DO HIGH8.1Munshi by Petpooja: invited sub-users can hard-delete company recordsMunshiOther2026-11-02 19:18 UTCby InfraStack Analyst–FIX 2026-07-07 HIGH7.1Munshi (Petpooja) lets invited sub-users delete the tenant owner's invoicesMunshiOther2026-11-02 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7Munshi by Petpooja: forged payment webhook grants paid subscription access without payingOther2026-11-02 19:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGleezCMS: directory traversal in media.php lets remote attackers read filesRuntime2026-11-02 19:18 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDOpenAirInterface 5G AMF: crafted registration request crashes core network processInfrastructure2026-11-02 19:18 UTCby EPSS–WHAT TO DO CRITICAL9.5Joomla Custom Tables extension: unauthenticated file upload to web-accessible directoryOther2026-11-02 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.3DJ-Classifieds for Joomla: logged-in users can read other sellers' private adsRuntime2026-11-02 19:17 UTCby EPSS–WHAT TO DO CRITICAL9.3DJ-Classifieds Joomla extension: unauthenticated SQL injection in frontend searchOther2026-11-02 19:17 UTCby EPSS–WHAT TO DO CRITICAL9.4DJ-Classifieds Joomla extension: authenticated file upload leads to code executionPackage2026-11-02 19:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCrewAI before 1.15.17: URL parser mismatch lets crafted URLs bypass the SSRF guardcrewaiAI agents & MCP2026-11-02 18:18 UTCby InfraStack Analyst–FIX 1.15.17 MEDIUMNOT SCOREDPrivate Internet Access Firefox extension leaks proxy credentials to malicious websitesOther2026-11-02 18:18 UTCby EPSS–WHAT TO DO MEDIUM6.9newspaper4k: image extractor allows server-side request forgery from article URLsPackage2026-11-02 18:18 UTCby EPSS–WHAT TO DO CRITICAL9.4Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual…Infrastructure2026-11-02 17:41 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDOpenAirInterface AMF: truncated SUCI crashes the 5G core processoai-cn5g-amfInfrastructure2026-11-02 18:18 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDOpenAirInterface AMF: repeated SCTP associations crash the processoai-cn5g-amfInfrastructure2026-11-02 18:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4FOSSBilling: stored XSS in support ticket notes hits adminsPackage2026-10-27 15:36 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDOpenAirInterface 5G core: oversized hex input crashes UDM via stack overflowoai-cn5g-udmOther2026-11-02 18:18 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDOpen5GS: repeated HTTP/2 headers leak memory and crash the network functionRuntime2026-11-02 18:18 UTCby EPSS–WHAT TO DO MEDIUM4.3Error pages reflect URL input, enabling phishing-style fake error messagesOther2026-11-02 18:18 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation@bytebase/dbhubAI agents & MCP2026-06-24 07:42 UTCby GitHub Advisories–FIX 0.22.6 MEDIUMINCIDENTGitHub: Elevated errors on GPT-5.4 NanoGitHubVendor2026-11-02 17:46 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in bfvkjmeikpwhqxc (npm)bfvkjmeikpwhqxcPackage2026-11-02 17:32 UTCby osv-malicious–UNINSTALL CRITICAL9.1SUSE Rancher Manager: meta proxy leaks credentials to cloud providersInfrastructure2026-10-29 17:26 UTCby EPSS–WHAT TO DO HIGH7.2Rancher Manager: role binding lets users gain permissions in downstream clustersInfrastructure2026-10-29 18:07 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in internal-renderers (npm)internal-renderersPackage2026-11-02 17:17 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pandafortunerush (npm)pandafortunerushPackage2026-11-02 17:17 UTCby osv-malicious–UNINSTALL MEDIUMNOT SCOREDFurl: unbounded HTTP response decompression lets a server exhaust client memoryPackage2026-11-02 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDNut/OS TCP stack: one crafted packet freezes all TCP servicesNut/OSInfrastructure2026-11-02 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.9Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in…Package2026-11-02 16:35 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDOpen5GS: PFCP transaction pool exhaustion crashes SMF/UPF, stopping session setupRuntime2026-11-02 17:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDFree5GC: failed PFCP session setup leaks UE IP addresses, enabling denial of serviceRuntime2026-11-02 17:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDKamailio: stack buffer overflow in ims_qos_npn lets crafted SIP REGISTER crash serverkamailioRuntime2026-11-02 17:17 UTCby InfraStack Analyst–FIX 6.1.5 HIGHNOT SCOREDKamailio: crafted NOTIFY message overflows stack and crashes P-CSCFRuntime2026-11-02 17:17 UTCby EPSS–WHAT TO DO CRITICAL9.3kaniko: lookalike registry hostname leaks Azure access token during image buildsPackage2026-11-02 16:32 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in aytidaoffc (npm)aytidaoffcPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in justinofficial (npm)justinofficialPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @levvicode/eslint-config (npm)@levvicode/eslint-configPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @levvicode/libsignal-node (npm)@levvicode/libsignal-nodePackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in levvleys (npm)levvleysPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nachles (npm)nachlesPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @maulenv/baileys (npm)@maulenv/baileysPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @levvicode/baileys (npm)@levvicode/baileysPackage2026-11-02 17:13 UTCby osv-malicious–UNINSTALL NOT SCOREDNOT SCOREDCVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandasPackage2026-11-02 16:40 UTCby Vendor & lab pages–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animate-final (npm)tailwind-animate-finalPackage2026-11-02 16:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animate-engine (npm)tailwind-animate-enginePackage2026-11-02 16:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animatrix (npm)tailwind-animatrixPackage2026-11-02 16:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-animate-test (npm)tailwind-animate-testPackage2026-11-02 16:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in unjailed (npm)unjailedPackage2026-11-02 16:58 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @mrlegendbot/libsignal-node (npm)@mrlegendbot/libsignal-nodePackage2026-11-02 16:56 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCloudflare: Worker Deployments DelayedCloudflareVendor2026-11-02 16:41 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: Some Customers May Have Incorrect Balances Reflected on Their AccountTwilioVendor2026-11-02 16:37 UTCby status page–WHAT TO DO LOWNOT SCOREDLinux kernel NTFS: fallocate race can expose stale disk data via mmapRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel NTFS: write faults race with truncate and fallocateRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: DAMON quota goal accepts zero target, risking division by zeroRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.8Linux kernel: Bluetooth L2CAP race can link a channel twicePackage2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Linux kernel: tracing instance removal can race module loads, freeing memorylinux-kernelInfrastructure2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Linux kernel: tracing readers can free boot data twice, causing memory corruptionlinux-kernelInfrastructure2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Linux kernel: incomplete tracing event filter reads out-of-bounds memoryRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Linux kernel: histogram removal lets tracing code read freed memoryRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: failed tracing command leaves histogram trigger activeRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.8Linux kernel: histogram cleanup can free a live synthetic trace eventRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: tracing syscall buffer copy skips user-address checkInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.8Linux kernel: io_uring waitid race lets a freed request be reused and corruptedRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring futex wait can crash the kernel after command reuseInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring wait loop can spin forever and ignore kill signalsRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDLinux kernel: io_uring exit can hang a thread on a FIFO openRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.8Linux kernel: repeated io_uring waitid cancellation can complete a request twiceRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: named keyring lookup can read freed memory during chownRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: keyring search can dereference a cleared authorization payloadRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.0Linux kernel: key describe can read freed module memory and crash1 talkingInfrastructure2026-11-02 16:17 UTCby InfraStack Analyst1talkingWHAT TO DO LOWNOT SCOREDLinux kernel: keyring order leaks kernel addresses, weakening KASLRRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: key read races module unload, risking freed-memory accessRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: trusted keys can instantiate after a failed TPM unsealInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDLinux kernel: keyring restriction crash lets an unprivileged user panic the systemRuntime2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: ftrace uninitialized variable crashes reading available_filter_functionsRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH7.0Linux kernel: coredump race can wake a freed thread's memorylinux-kernelRuntime2026-11-02 16:17 UTCby InfraStack Analyst–FIX 6.1.191 NOT SCOREDNOT SCOREDLinux kernel: failed fork can deadlock against sched_ext and block all forksRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.1SUSE Rancher Fleet: an ordinary Rancher user can get cluster-admin on the management clusterfleetInfrastructure2026-10-29 17:26 UTCby InfraStack Analyst–FIX 0.13.17 HIGH7.6SUSE Rancher Manager: authenticated users can make the server request destinations the /meta/proxy allowlist should block (SSRF)rancherInfrastructure2026-10-29 17:26 UTCby InfraStack Analyst–FIX 2.11.19 MEDIUM6.9Control Web Panel: blind SQL injection in unauthenticated loopback routeRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH8.6Control Web Panel: password change route lets attackers run root commandsInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH8.5Control Web Panel: SQL injection in loopback API lets attackers bypass authenticationInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH8.6Control Web Panel: database restore route lets a request run root commandsRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO HIGH8.6Control Web Panel: loopback API skips authentication, exposing root-level routesRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Control Web Panel: unescaped file parameter lets users run OS commandsRuntime2026-11-02 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.1wrensec-commons CREST: reflected XSS via _mimeType parameter in HTTP bindingPackage2026-11-02 15:03 UTCby EPSS–WHAT TO DO CRITICALNOT SCOREDINFINITT PACS: crafted imodular URI lets an attacker run codeINFINITT PACS System ManagerVendor2026-11-02 16:17 UTCby InfraStack Analyst–FIX 3.0.12.3 MEDIUM6.9Otter Wiki: DataTable embedding lets editors read repository-internal filesPackage2026-11-02 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Otter Wiki: stored script injection through math code blocksOther2026-11-02 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Eclipse ThreadX: loaded modules can control other modules' threadsRuntime2026-11-01 17:32 UTCby EPSS–WHAT TO DO HIGH7.0Eclipse ThreadX: user-mode module can write privileged memory via PendSVthreadxRuntime2026-11-01 17:32 UTCby InfraStack Analyst–FIX 6.5.2.202603b HIGH8.7Eclipse ThreadX NetX Duo: forged ICMPv6 messages crash network stackRuntime2026-11-01 17:32 UTCby EPSS–WHAT TO DO HIGH8.4Krill: a CA operator can act as any child CA when the parent is on the same Krill serverInfrastructure2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4Krill: CA-restricted role gets full permissions on bulk CA importOther2026-11-02 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4Krill: any logged-in user can forge an admin session token because the encryption nonce resets on restartkrillInfrastructure2026-11-02 16:17 UTCby InfraStack Analyst–FIX 0.16.1 HIGH8.6Control Web Panel: unauthenticated shell injection grants root command executionInfrastructure2026-11-02 16:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @bigdevin55/calculator-install-demo (npm)@bigdevin55/calculator-install-demoPackage2026-11-02 16:14 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @bigdevin55/calculator-install-hook (npm)@bigdevin55/calculator-install-hookPackage2026-11-02 16:14 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @nuxzofficial/baileys (npm)@nuxzofficial/baileysPackage2026-11-02 16:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nuxzofficial (npm)nuxzofficialPackage2026-11-02 16:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwindcss-animate-bridge (npm)tailwindcss-animate-bridgePackage2026-11-02 15:50 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @utilitycraft/tailwindcss-motion-atelier (npm)@utilitycraft/tailwindcss-motion-atelierPackage2026-11-02 15:50 UTCby osv-malicious–UNINSTALL CRITICALCAMPAIGNEXPLOITEDAttackers log in as admin on outdated BTCPay Server instances (2.4.1 and older) and drain their hot walletsBTCPay ServerVendor2026-11-02 15:03 UTCby InfraStack Analyst–FIX 2.4.7 MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio Alphanumeric Sender IDs to T-Mobile AustriaTwilioVendor2026-11-02 15:32 UTCby status page–WHAT TO DO CRITICALINCIDENTSentry: Sentry dashboard is downSentryVendor2026-11-02 15:20 UTCby status page–WHAT TO DO CRITICAL9.8Control Web Panel: file write and OS command injection enable remote code executionOther2026-11-02 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Control Web Panel: missing exit after redirect lets unauthenticated users reach admin codeRuntime2026-11-02 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.8Control Web Panel: path traversal lets attackers include arbitrary PHP filesRuntime2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.3Chainlit 2.12.0: semicolon in MCP URLs bypasses path-restricted allowed_urlschainlitAI agents & MCP2026-08-25 17:06 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.4Wing FTP Server: stored script injection lets users run code in admin browsersRuntime2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Outline: authenticated members can publish documents into private collectionsPackage2026-10-24 02:47 UTCby EPSS–WHAT TO DO MEDIUM5.4LaraDashboard: stored script injection through page builder blocks hits admin sessionsOther2026-11-01 19:00 UTCby EPSS–WHAT TO DO HIGH8.6LaraDashboard: non-superadmin users can run core upgrades and dump databasePackage2026-11-01 19:02 UTCby EPSS–WHAT TO DO HIGH8.8Jpom: authenticated users can run SSH commands on other workspaces' hostsPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.8Jpom: cross-workspace bypass lets users control other workspaces' Docker hostsInfrastructure2026-11-02 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.1python-jose: empty HMAC secret lets attackers forge accepted JWT tokensPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Kvazaar: truncated Y4M header makes the encoder hang foreverPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.8libaec: out-of-bounds read in decoder can crash or leak memoryPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.9L-SMASH: crafted MP4 files corrupt heap memory and crash appsPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.9rapidyaml: crafted YAML with excess anchors corrupts memory and crashesPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.8The Sleuth Kit: crafted HFS+ image crashes the forensic toolPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM4.8The Sleuth Kit: crafted HFS+ image causes heap out-of-bounds readPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.4libgphoto2: malicious USB camera thumbnail corrupts memory and leaks heapPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH7.0libgphoto2: malicious USB camera overflows memory during camera setupPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.3LaraDashboard: read-only users can send arbitrary email via MCP toolAI agents & MCP2026-11-01 19:02 UTCby EPSS–WHAT TO DO MEDIUM6.9Outline: unpublished documents readable through share links before 1.12.0Other2026-10-24 02:47 UTCby EPSS–WHAT TO DO HIGH8.6DoraCMS: mass assignment lets low-privileged users take over other accountsDoraCMSPackage2026-11-02 15:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.2HotGo: SMS login bypass lets attackers take over accounts, including adminsOther2026-11-02 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.4madong-admin-saas: missing authentication lets anyone manage tenant accountsPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.8madong-admin-saas: tenant login token reaches platform admin APImadong-admin-saasOther2026-11-02 15:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.1GoFound: path traversal lets unauthenticated users delete arbitrary directoriesgofoundPackage2026-11-02 15:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1GoFound: unauthenticated stored script injection runs in admin browsersOther2026-11-02 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.8ape-volo-admin: hardcoded JWT key lets attackers forge admin tokensOther2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.9OwnTone Server: SQL injection over MPD port lets attackers read media pathsPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.9QuickJS-NG: memory leak in Atomics.store lets scripts exhaust heapRuntime2026-07-31 15:05 UTCby EPSS–WHAT TO DO HIGH8.3QuickJS-NG: integer overflow in typed array sort lets scripts corrupt memoryRuntime2026-07-31 15:04 UTCby EPSS–WHAT TO DO HIGH8.5QuickJS-NG: integer overflow in Proxy handling lets scripts corrupt memoryRuntime2026-07-31 15:04 UTCby EPSS–WHAT TO DO MEDIUM6.9Netpbm: crafted Targa file reads out of bounds in converterPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted JBIG file overflows heap buffer in jbigtopnmPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted XPM file overflows heap in xpmtoppm converterPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted PICT file overflows stack in picttoppm converterPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted PICT file overflows stack in picttoppm, enabling code executionPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted icon file corrupts heap memory in winicontopamPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.5Netpbm: crafted SGI image file overflows heap buffer, risking code executionPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Camaleon CMS: low-privilege users can rename or delete other categoriesOther2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH7.1Camaleon CMS: low-privileged users can bypass media permissions and upload filesPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.1PandaWiki: stored XSS lets attackers steal admin session tokensPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.3MrDoc: missing authorization lets logged-in users read others' document templatesPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.7OpenCSG CSGHub: unauthenticated request reads private repository filescsghubOther2026-11-02 15:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Chatify: authorization bypass lets users read other users' private messagesPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH8.6PUBLIC EXPLOITWooCommerce gallery plugin lets shop managers take over the sitePackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Eclipse ThreadX: Module Manager mutex left locked after overflow errorRuntime2026-11-01 17:32 UTCby EPSS–WHAT TO DO MEDIUM4.8inih: one-byte stack under-read in INI parser via embedded NULPackage2026-11-02 15:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDKeyfactor EJBCA: client certificate self-renewal skips authorization checksInfrastructure2026-11-02 15:17 UTCby EPSS–WHAT TO DO HIGH7.5Starnet Inventory Tracking Application: SQL injection lets attackers read database dataInventory Tracking ApplicationOther2026-11-02 14:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Warracker: Paperless-ngx link lets users read other users' private documentsOther2026-10-31 22:58 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Syncope: admin SQL injection via opEvent lets attackers run arbitrary SQLPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache Syncope: admin-created Groovy class escapes sandbox by running on new threadPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache Syncope: delegated admins can move realms they should not controlPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDApache Arrow Rust: out-of-bounds read from malformed RunEndEncoded arraysPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Syncope: non-admin users can configure impersonation for surrogate loginPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache Syncope: admin-imported BPMN processes run unsandboxed JUEL expressions on serverPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGH8.6Joomla Helix Ultimate: stored XSS in mega menu badge textOther2026-11-02 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Joomla StageIt extension: reflected cross-site scripting in versions 1.0-5.7.5 and 6.0-6.3.5Package2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGH8.6Joomla StageIt extension: setting strings let attackers run remote codeStageItOther2026-11-02 14:17 UTCby InfraStack Analyst–FIX 5.8.0 HIGH7.2Joomla StageIt extension: cross-site request forgery on various actionsStageItRuntime2026-11-02 14:17 UTCby InfraStack Analyst–FIX 5.8.0 HIGH8.6Joomla Helix Ultimate template: stored XSS in Media Picker before 2.2.11Other2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGH8.9Joomla Sourcerer extension can run PHP from included articles uncheckedPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.1Joomla Users Anywhere: content tags can override email and username privacy settingsPackage2026-11-02 14:17 UTCby EPSS–WHAT TO DO HIGHCAMPAIGNEXPLOITEDXCPEx.cpeAndroid TV set-top boxes from OEM Videostrong ship with a factory-installed backdoor (XCPE) that sold access for ad fraud, residential proxies and more malware; 1.3M+ devices (Google)Videostrong Android TV set-top boxesVendor2026-11-02 14:00 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in atlassian-wallboard-plugin1 (npm)atlassian-wallboard-plugin1Package2026-11-02 13:34 UTCby osv-malicious–UNINSTALL HIGH8.0Dell OpenManage Enterprise: OS command injection lets low-privileged users run commandsInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO HIGH7.8eta-register: missing authorization lets users escalate privilegesPackage2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Dell OpenManage Enterprise: path traversal gives attacker filesystem accessInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM5.7Dell OpenManage Enterprise: path traversal exposes information to nearby low-privilege usersInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Dell OpenManage Enterprise: argument injection lets a low-privileged user run commandsInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM5.7Dell OpenManage Enterprise: signature check flaw allows code execution by adminsInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.8Dell OpenManage Enterprise: cross-site scripting lets remote attackers tamper with informationInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Dell OpenManage Enterprise: low-privileged local user can bypass protection mechanismInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.4Dell OpenManage Enterprise: signature check flaw lets a local admin write filesInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Dell OpenManage Enterprise: low-privilege local user can bypass protection mechanismInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Dell OpenManage Enterprise: path traversal gives attacker filesystem accessInfrastructure2026-11-02 13:17 UTCby EPSS–WHAT TO DO CRITICAL9.3Barracuda Email Security Gateway: authentication bypass lets attackers change global configurationEmail Security Gateway1 talkingInfrastructure2026-11-02 13:17 UTCby InfraStack Analyst1talkingFIX 9.4.0.030 HIGH8.6Barracuda appliances: timezone field lets an admin run root OS commands1 talkingInfrastructure2026-11-02 13:17 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUM4.3Unnamed product: callback URL validation flaw enables redirects to phishing pagesOther2026-11-02 13:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTFly.io: Elevated Machine start failures in ARNFly.ioVendor2026-11-02 12:34 UTCby status page–WHAT TO DO HIGHCAMPAIGNEXPLOITEDDanfoss freezer attacksInternet-exposed Danfoss supermarket refrigeration controllers hijacked to heat fridges and freezers to 50°C overnight; attacks now reported in 12 countries including RomaniaDanfoss AK-SM 800A7 talkingInfrastructure2026-10-13by InfraStack Analyst7talkingFIX R4.3.1 LOW1.9Qt: integer overflow in XML parsing may crash or misbehavePackage2026-11-02 12:16 UTCby EPSS–WHAT TO DO MEDIUM4.9WSO2 products: refresh tokens still issue access tokens for blocked accountsOther2026-11-02 12:16 UTCby EPSS–WHAT TO DO HIGHCAMPAIGNDON'T CLICKFake IT support on Microsoft Teams gets remote control via Quick Assist, then abuses misconfigured AD CS (ESC1, ESC8) for domain-admin certificates and steals data (Microsoft)Microsoft TeamsInfrastructure2026-11-02 11:08 UTCby InfraStack Analyst–WHAT TO DO HIGHINCIDENTFly.io: Emergency maintenance in IADFly.ioVendor2026-11-02 11:19 UTCby status page–WHAT TO DO HIGH8.7ManageEngine Log360 and Eventlog Analyzer: authenticated remote code execution via Log ForwardVendor2026-11-02 11:17 UTCby EPSS–WHAT TO DO HIGH8.7WSO2 API Manager and related products: blind SQL injection in Admin REST API by administratorsWSO2 API ManagerOther2026-11-02 11:17 UTCby InfraStack Analyst–FIX 4.6.0 U15 MEDIUM5.9Fastify: slow streaming responses crash the Node.js process after a timeoutPackage2026-11-02 10:49 UTCby EPSS–WHAT TO DO LOW3.7@fastify/cors: preflight request can crash Node.js process with onSendPackage2026-11-02 08:50 UTCby EPSS–WHAT TO DO MEDIUM5.9@fastify/http-proxy: encoded backslashes let requests escape the proxy prefixPackage2026-11-02 08:53 UTCby EPSS–WHAT TO DO CRITICAL9.1@fastify/http-proxy: route parameters can escape the pinned upstream pathPackage2026-11-02 08:55 UTCby EPSS–WHAT TO DO MEDIUM4.2@fastify/secure-session: stale signed cookies still decrypt after signing secret rotationPackage2026-11-02 09:08 UTCby EPSS–WHAT TO DO MEDIUM5.9@fastify/multipart: malformed upload leaves requests hanging, exhausting server connectionsPackage2026-11-02 09:13 UTCby EPSS–WHAT TO DO HIGH8.2@fastify/reply-from: backslash dot-segments bypass path checks, reaching other upstream endpointsPackage2026-11-02 09:02 UTCby EPSS–WHAT TO DO MEDIUM4.8Publisher portal: uploaded SVG files can carry scripts to other users' browsersOther2026-11-02 11:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Unnamed components accept crafted redirect URLs to arbitrary external domainsOther2026-11-02 11:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in persona-ai-sdk (npm)persona-ai-sdkPackage2026-11-02 11:02 UTCby osv-malicious–UNINSTALL MEDIUM4.4WSO2 Event Publisher logs irrelevant adapter properties, exposing credentials in logsOther2026-11-02 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Unnamed product: SQL injection lets logged-in users steal database contentsOther2026-11-02 10:17 UTCby EPSS–WHAT TO DO MEDIUM5.8Unnamed component leaks certificate file paths via crafted content-type headerOther2026-11-02 10:17 UTCby EPSS–WHAT TO DO MEDIUM4.6Management console user search lets injected scripts run in browsersOther2026-11-02 10:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Long Codes to T-Mobile Czech RepublicTwilioVendor2026-11-02 09:46 UTCby status page–WHAT TO DO LOW2.3Qt MQTT: memory corruption in QMqttClient can crash applicationsPackage2026-11-02 09:17 UTCby EPSS–WHAT TO DO HIGH8.8ManageEngine Password Manager Pro and PAM360: authenticated remote code execution flawVendor2026-11-02 08:17 UTCby EPSS–WHAT TO DO MEDIUM5.3PayHere WordPress plugin: forged payment notices mark orders paidPackage2026-11-02 08:17 UTCby EPSS–WHAT TO DO MEDIUM5.5Bluetooth module permission flaw may disrupt device availabilityOther2026-11-02 08:17 UTCby EPSS–WHAT TO DO MEDIUM6.6Autofill service module flaw may expose data confidentialityOther2026-11-02 08:17 UTCby EPSS–WHAT TO DO HIGH7.5XunRuiCMS up to 4.7.4: unauthenticated code injection via dirname in zzmob/index.php, public PoC, no vendor fixXunRuiCMSOther2026-11-02 07:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Huawei HarmonyOS 6.1.0 window module flaw can cause denial of serviceHarmonyOSOther2026-11-02 07:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.9Peripheral module: out-of-bounds read may expose service dataInfrastructure2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM5.9Location service module use-after-free may crash the affected componentOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM5.9Location service module race condition may disrupt availabilityOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM5.5WLAN module permission flaw may expose confidential service dataInfrastructure2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM4.3Unnamed product: file parsing flaw can crash the serviceOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM4.7Unnamed product: file preview buffer overflow may disrupt availabilityOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO LOW3.7Optimizer module permission control flaw may expose service dataOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO HIGH7.1Huawei HarmonyOS and EMUI: permission flaw in event notification management module can expose service dataHarmonyOSOther2026-11-02 07:18 UTCby InfraStack Analyst–FIX October 2026 security update MEDIUM4.3ArkWeb module: null pointer dereference can crash the browser componentInfrastructure2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM5.7DSoftBus module: denial-of-service flaw can disrupt device availabilityInfrastructure2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM6.5DSoftBus module: denial-of-service flaw can disrupt device availabilityOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM6.2Graphics module permission flaw may expose data to attackersInfrastructure2026-11-02 07:18 UTCby EPSS–WHAT TO DO LOW3.6Background task module permission flaw may affect service integrityOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUM4.0Unnamed product: file parsing flaw lets an attacker crash the serviceOther2026-11-02 07:18 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Missing Redirects in IndonesiaTwilioVendor2026-11-02 06:54 UTCby status page–WHAT TO DO HIGH7.5XunRuiCMS: email template rendering lets remote attackers inject codexunruicmsOther2026-11-02 06:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5XunRuiCMS: member module catid parameter allows SQL injection remotelyPackage2026-11-02 06:17 UTCby EPSS–WHAT TO DO CRITICAL10.0WAVLINK WN551X3-A router: remote OS command injection via DNS handlerWN551X3-AInfrastructure2026-11-02 06:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.4WSO2 API Manager and related products: System REST APIs let low-privilege users run admin actions (CVE-2025-11969)WSO2 API ManagerOther2026-11-02 06:17 UTCby InfraStack Analyst–FIX 4.5.0 U32 MEDIUM4.8Account lockout skipped on primary user store when usernames collideInfrastructure2026-11-02 06:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in scdn-jquery (npm)scdn-jqueryPackage2026-11-03 03:47 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Voice Call Failures from a Subset of Twilio Philippines Phone Numbers to Multiple Networks in PhilippinesTwilioVendor2026-11-02 05:41 UTCby status page–WHAT TO DO CRITICAL10.0WAVLINK router: remote OS command injection via WireGuard group handlerWN551X3-AInfrastructure2026-11-02 05:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.0CloudClassroom-PHP-Project: cross-site scripting in assessment form fieldsPackage2026-11-02 05:18 UTCby EPSS–WHAT TO DO HIGH7.5CloudClassroom-PHP-Project: SQL injection in viewquery.php lets attackers read databaseCloudClassroom-PHP-ProjectOther2026-11-02 05:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5CloudClassroom-PHP-Project: studentdetails.php keeps running after a redirect, so protected content can be reached without loginCloudClassroom-PHP-ProjectPackage2026-11-02 05:18 UTCby InfraStack Analyst–WHAT TO DO LOW3.7CloudClassroom-PHP-Project: global session handler lets remote attackers expire sessionsOther2026-11-02 05:18 UTCby EPSS–WHAT TO DO MEDIUM5.0CloudClassroom-PHP-Project: XSS via fname parameter in updatedetailsfromfaculty.phpPackage2026-11-02 04:16 UTCby EPSS–WHAT TO DO HIGH7.5VStarcam O-KAM SuperIPCam: use-after-free in P2P session teardown, remoteO-KAM SuperIPCamOther2026-11-02 04:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5VStarcam O-KAM Client: stack buffer overflow lets remote attackers run codeO-KAM ClientOther2026-11-02 04:16 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/franchise-management (npm)@goparrot-dashboard/franchise-managementPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard-api/users (npm)@goparrot-dashboard-api/usersPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/order (npm)@goparrot-dashboard/orderPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/analytics (npm)@goparrot-dashboard/analyticsPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/franchise-directory (npm)@goparrot-dashboard/franchise-directoryPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/settings (npm)@goparrot-dashboard/settingsPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/franchise-menu-settings (npm)@goparrot-dashboard/franchise-menu-settingsPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard-api/role-v2 (npm)@goparrot-dashboard-api/role-v2Package2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/store (npm)@goparrot-dashboard/storePackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard-api/shared (npm)@goparrot-dashboard-api/sharedPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/marketing (npm)@goparrot-dashboard/marketingPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/auth (npm)@goparrot-dashboard/authPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/payment (npm)@goparrot-dashboard/paymentPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/homepages (npm)@goparrot-dashboard/homepagesPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/franchise-marketing (npm)@goparrot-dashboard/franchise-marketingPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/i18n (npm)@goparrot-dashboard/i18nPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/promotion (npm)@goparrot-dashboard/promotionPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/menu (npm)@goparrot-dashboard/menuPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/combo-group (npm)@goparrot-dashboard/combo-groupPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/category (npm)@goparrot-dashboard/categoryPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/loyalty (npm)@goparrot-dashboard/loyaltyPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard-api/orchestration (npm)@goparrot-dashboard-api/orchestrationPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard-api/store (npm)@goparrot-dashboard-api/storePackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @goparrot-dashboard/combos (npm)@goparrot-dashboard/combosPackage2026-11-02 03:53 UTCby osv-malicious–UNINSTALL NOT SCOREDNOT SCOREDModem: permissions bypass lets an app with System privilege escalate furtherInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDip_stack: out-of-bounds read lets a rogue base station crash a phoneOther2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a System-privileged process escalateInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: integer overflow lets a rogue base station crash the deviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: logic error lets a rogue base station crash the applicationInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: missing permission check allows privilege escalation locallyInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: integer overflow lets a rogue base station crash a phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds read lets a rogue base station crash a phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds read lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDNeuroPilot: out-of-bounds write lets a process with System privilege escalateInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds read lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: improper input validation lets a rogue base station crash the modemRuntime2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: side channel lets a system-privilege process read informationInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGPU pdma driver: missing permission check allows local privilege escalationInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid display component: logic error can crash the systemInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station escalate privilegeInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux USB driver: missing bounds check allows memory corruption, local privilege escalationInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid USB driver use-after-free can crash the system locallyInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid USB driver: double free lets a privileged process corrupt memoryInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid USB driver: use-after-free lets a privileged process escalate furtherInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux USB driver use-after-free can crash the system locallyInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: side-channel flaw leaks data and enables remote denial of serviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: permission bypass lets a privileged process cause local denial of serviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid AFE component: out-of-bounds write lets a local app escalate privilegeInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAFE driver: use-after-free lets a System-privileged process corrupt memoryInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAFE driver: use-after-free lets a System-privileged process corrupt memoryInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAFE: double free memory corruption lets a System-privilege process escalateInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDadsp: integer overflow lets a system-level process write out of boundsInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid afe driver: use-after-free lets a local process escalate privilegeInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDadsp: use-after-free lets a system-privileged process escalate privilegesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid adsp: use-after-free lets a System-privileged app escalate furtherInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid afe driver: use-after-free can crash system and escalate privilegeInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid AFE driver: out-of-bounds write lets system-level code escalate privilegesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station crash devicesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets local code escalate privilegesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write from a bad bounds check crashes the deviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: improper input validation lets a rogue base station crash the deviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGPU pdma driver: use-after-free allows local privilege escalation to higher rightsInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDGPU pdma driver: use-after-free lets local user escalate privilegesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station take overInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDModem: out-of-bounds write lets a rogue base station escalate privilegeMediaTek modem chipsetsInfrastructure2026-11-02 03:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds read lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: missing bounds check lets a rogue base station crash the phoneInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDDA: out-of-bounds write lets a device attacker gain higher privilegesInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDMediaTek modem driver: out-of-bounds write allows remote denial of serviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid GNSS: missing bounds check allows out-of-bounds write locallyInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDAndroid GNSS: out-of-bounds write lets a local app crash the deviceInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station escalate privilegeInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station take controlInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station take overInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station take overInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem: out-of-bounds write lets a rogue base station take overInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDModem firmware: out-of-bounds write lets a rogue base station take overInfrastructure2026-11-02 03:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Farm: path traversal in model loader lets local files be readPackage2026-11-02 03:17 UTCby EPSS–WHAT TO DO MEDIUM5.0deepset FARM: tokenizer loader lets remote requests traverse file pathsPackage2026-11-02 03:17 UTCby EPSS–WHAT TO DO HIGH7.5Knip: path traversal in workspace handler lets attackers write filesPackage2026-11-02 03:17 UTCby EPSS–WHAT TO DO HIGH8.3Zilla: path traversal in HTTP filesystem binding exposes server filesRuntime2026-11-02 03:17 UTCby EPSS–WHAT TO DO HIGH8.2http4k: digest auth skips request body, letting on-path attackers alter requestsPackage2026-10-16 16:10 UTCby EPSS–WHAT TO DO HIGH8.2http4k: path traversal in Thymeleaf templates lets attackers read server filesPackage2026-10-16 16:12 UTCby EPSS–WHAT TO DO HIGH8.8LobeHub Chat: path traversal lets logged-in users overwrite server filesAI agents & MCP2026-10-17 19:28 UTCby EPSS–WHAT TO DO HIGH7.3Network-AI: A2AServer lets unauthenticated callers run and cancel agent tasksAI agents & MCP2026-10-17 18:17 UTCby EPSS–WHAT TO DO HIGH8.7Network-AI: path traversal lets attackers read and write files outside sandboxPackage2026-10-17 18:17 UTCby EPSS–WHAT TO DO HIGH8.8Network-AI: path traversal in AgentVCR lets attackers read or overwrite JSON filesAI agents & MCP2026-10-17 18:17 UTCby EPSS–WHAT TO DO HIGH8.8Network-AI: path traversal in job store reads or deletes arbitrary JSON filesAI agents & MCP2026-10-17 18:16 UTCby EPSS–WHAT TO DO LOW3.1Parse Server: object update responses leak stored field values to write-only clientsPackage2026-10-18 00:50 UTCby EPSS–WHAT TO DO MEDIUM6.3Nuxt: encoded question mark in path lets requests read the wrong route parameterRuntime2026-10-16 18:58 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in contracts-upgradeable (npm)contracts-upgradeablePackage2026-11-02 02:31 UTCby osv-malicious–UNINSTALL MEDIUM5.3MCPHub: header passthrough flaw can leak information to remote callersAI agents & MCP2026-11-02 02:18 UTCby EPSS–WHAT TO DO CRITICAL9.9Termix: path traversal in file transfer endpoint lets remote users write filesOther2026-11-02 02:18 UTCby EPSS–WHAT TO DO MEDIUM5.8MoviePilot: unsafe deserialization in workflow fork endpoint allows remote attackPackage2026-11-02 02:18 UTCby EPSS–WHAT TO DO MEDIUM6.5PublicCMS: refund update flaw lets remote users bypass authorizationOther2026-11-02 02:18 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)@an1mshnpmb9c84920/pipeprobe-obf-m19n5Package2026-11-02 01:50 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @axo_cuy/baileys (npm)@axo_cuy/baileysPackage2026-11-02 01:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @bil-rgb/baileys (npm)@bil-rgb/baileysPackage2026-11-02 01:41 UTCby osv-malicious–UNINSTALL CRITICAL10.0Linksys E8450 router: remote stack overflow via portal.cgi timezone fieldE8450Infrastructure2026-11-02 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9WAVLINK WN536AX6-A router: remote command injection via host_black MAC argumentWN536AX6-AInfrastructure2026-11-02 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handlerWN536AX6-AInfrastructure2026-11-02 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0WAVLINK WN536AX6-A router: WireGuard group handler command injection, firmware V260507WN536AX6-AInfrastructure2026-11-02 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0WAVLINK WN536AX6-A router: remote command injection via protocol.csp file_idWN536AX6-AInfrastructure2026-11-02 01:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Short Codes to Google Voice United StatesTwilioVendor2026-11-02 00:51 UTCby status page–WHAT TO DO MEDIUM5.5WAVLINK WN536AX6-A router: VPN client list handler lacks authenticationInfrastructure2026-11-02 00:18 UTCby EPSS–WHAT TO DO CRITICAL10.0WAVLINK WN536AX6-A router: command injection via WireGuard group name, no fix listedWN536AX6-AInfrastructure2026-11-02 00:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0WAVLINK WN536AX6-A router: web interface command injection allows remote code executionWN536AX6-AInfrastructure2026-11-02 00:18 UTCby InfraStack Analyst–WHAT TO DO

Sunday, Nov 1Monday, Nov 2Tuesday, Nov 3