Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 890 threats · last 24 hours· last check 2026-11-04 06:00 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Last 24 hours

Most severe in everything

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Attackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)Node-RED1 talking

BREACHNO CVE YET

Attackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress)Microsoft Entra ID

BREACHNO CVE YET

GitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknownGitBook

MALWARENO CVE YET

EXPLOITED IN THE WILD

3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)Veeam Backup & Replication

Wednesday, Nov 4

MEDIUM5.4Akeeba products: missing anti-CSRF check lets malicious pages trigger actionsOther2026-11-04 05:18 UTCby NVD–WHAT TO DO MEDIUMINCIDENTFly.io: Emergency network maintenance on a subset of hosts in ORDFly.ioVendor2026-11-04 05:01 UTCby status page–WHAT TO DO HIGH7.6Unisoc bootloader out-of-bounds write in firmware download module (CVE-2026-80335)Unisoc bootloader (download module)Infrastructure2026-11-04 04:17 UTCby InfraStack Analyst–FIX Android security patch level 2026-11-05 HIGH7.5Unisoc UDX710 modem firmware: malformed PUCCH configuration can crash the modem remotelyUDX710 modem firmwareInfrastructure2026-11-04 04:17 UTCby InfraStack Analyst–WHAT TO DO HIGH9.3Unisoc UFS firmware update (FFU) flaw: out-of-bounds write can give local code execution or crashUnisoc UFS firmware (FFU)Infrastructure2026-11-04 04:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMINCIDENTSupabase: Intermittent errors on Supavisor Shared Pooler in us-east-2SupabaseVendor2026-11-04 03:48 UTCby status page–WHAT TO DO CRITICAL9.1better-auth Expo plugin: forged login state enables account takeoverPackage2026-11-03 21:37 UTCby NVD–WHAT TO DO MEDIUM5.5Linksys E5600 router: factory test CGI leaks information remotelyInfrastructure2026-11-04 03:17 UTCby NVD–WHAT TO DO HIGH7.8Linksys E5600 router: firmware upload handler lets remote attackers write out of boundsE5600Infrastructure2026-11-04 03:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5Linksys E5600 router: JSON request parser overflow in mesh loginInfrastructure2026-11-04 03:17 UTCby NVD–WHAT TO DO CRITICAL10.0Linksys E5600 router: login handler flaw allows remote authentication bypassE5600Infrastructure2026-11-04 03:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7ASUS router firmware: crafted device name lets nearby attacker run root commandsASUS Router firmwareInfrastructure2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2ASUS router firmware: out-of-bounds write from crafted nearby packetsInfrastructure2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5funadmin: SQL injection in frontend list endpoint lets attackers run queriesfunadmin/funadminPackage2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0Qihoo 360 M5 router: hard-coded credentials in boot script360 Whole Home Router M5Infrastructure2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Qihoo 360 D603-2 router firmware: timezone parameter allows remote command injectionInfrastructure2026-11-04 02:17 UTCby NVD–WHAT TO DO CRITICAL10.0Qihoo 360 D603-2 and D706 routers: remote command injection via host argumentQihoo 360 D603-2Infrastructure2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.5ASUS System Control Interface: local user can read and write physical memoryInfrastructure2026-11-04 02:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9ASUS Armoury Crate: local users can write files as SYSTEMOther2026-11-04 02:17 UTCby NVD–WHAT TO DO CRITICAL10.0Qihoo 360 router firmware: signature check flaw allows unsigned firmware installsInfrastructure2026-11-04 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9TOTOLINK A950RG router: remote stack overflow in MAC filter handlerA950RG firmwareInfrastructure2026-11-04 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9TOTOLINK A950RG router: remote stack overflow via Wi-Fi multi-SSID settingsInfrastructure2026-11-04 01:17 UTCby NVD–WHAT TO DO CRITICAL9.9TOTOLINK A950RG router: remote stack overflow in wireless config handlerA950RGInfrastructure2026-11-04 01:17 UTCby InfraStack Analyst–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in yzx-npm (npm)yzx-npmPackage2026-11-04 01:17 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in mocha-ui-themes (npm)mocha-ui-themesPackage2026-11-04 01:03 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: MMS Delivery Failures from a Subset of Twilio Long Codes to GCI United StatesTwilioVendor2026-11-04 00:27 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-form-core (npm)tailwind-form-corePackage2026-11-04 00:26 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in react-contact-forms (npm)react-contact-formsPackage2026-11-04 00:26 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tailwind-input-kit (npm)tailwind-input-kitPackage2026-11-04 00:24 UTCby osv-malicious–UNINSTALL HIGH7.8OpenUSD: crafted USDC or USDZ file can run code via double freePackage2026-11-04 00:17 UTCby NVD–WHAT TO DO HIGH7.8Quest Foglight for Databases: folder permissions let local users gain SYSTEMFoglight for DatabasesVendor2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH7.8Quest Foglight for Databases: hardcoded key lets local user gain SYSTEMFoglight for DatabasesPackage2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.2Quest Foglight for Databases: XML parsing flaw leaks server-side data to remote attackersFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: directory traversal in unzipFile allows code executionFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH7.2Quest Foglight for Databases: template injection lets authenticated users run codeFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: path traversal lets authenticated users run codeFoglight for DatabasesVendor2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: path traversal lets authenticated attackers run codeFoglight for DatabasesPackage2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 MEDIUM6.5Quest Foglight for Databases: authenticated file path flaw leaks sensitive informationOther2026-11-04 00:17 UTCby NVD–WHAT TO DO HIGH8.8Quest Foglight for Databases: directory traversal lets authenticated users run codeFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: flawed authorization lets attackers run codeFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 CRITICAL9.8Quest Foglight for Databases: unauthenticated remote code execution as SYSTEM via deserializationFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 CRITICAL9.8Quest Foglight for Databases: unauthenticated file path flaw allows remote code executionFoglight for DatabasesVendor2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 CRITICAL9.8Quest Foglight for Databases: unauthenticated remote code execution via ForgeMBeanServerSupportFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: path traversal lets authenticated users run codeFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH8.8Quest Foglight for Databases: path traversal lets authenticated users run codeFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 HIGH7.2Quest Foglight for Databases: XML parser flaw leaks server files to attackersFoglight for DatabasesOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 8.3 CRITICAL9.9TOTOLINK A950RG router: stack overflow in setup wizard lets remote attackers inA950RG firmwareInfrastructure2026-11-04 00:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5spatie url-signer: incorrect type conversion in URL validation bypasses signed-URL checksPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUM4.3RAGFlow: Text-to-SQL retrieval flaw lets remote users bypass authorizationragflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5PublicCMS 5: pending refund check lets a user act on other accountsRuntime2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI module: short request body hangs server process indefinitelyPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: missing request size limits let attackers exhaust memory and diskPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDPerl CGI: unescaped comment text lets attackers inject HTMLPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDPerl CGI: unescaped quotes let attachment filenames be spoofedPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDPerl CGI: plain string input crashes uploadInfo, denying servicePackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI: crafted form values can crash or stall scrolling_list renderingPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDPerl CGI::Cookie: unchecked path, domain and expires values allow cookie attribute injectionPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: URLs with raw apostrophes enable cross-site scriptingPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI module returns request values untainted, bypassing taint checksPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI module: upload filenames keep client-supplied path componentsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: request body parameters can be spoofed from query stringPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: header injection through entity decoding and multipart outputPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: redirect decodes HTML entities, sending users to other hostsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI module reads request parameters from command line argumentsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: crafted REQUEST_URI builds redirects to other hostsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: multipart parser lets form fields slip past WAFsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI::Carp leaks one user's warnings into another user's pagePackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI: client-supplied X-Forwarded-Host header poisons generated URLsPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl CGI module: crafted Content-Type header can exhaust CPUPackage2026-11-04 00:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPerl CGI::Cookie: crafted cookie expires value causes denial of servicePackage2026-11-04 00:17 UTCby NVD–WHAT TO DO HIGH8.2MLflow: get-artifacts endpoint lets remote users read server-side datamlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.17.0 HIGH7.8MLflow: SHAP explainer loading lets a crafted file run codemlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.17.0 MEDIUM5.4MLflow Tracking Server: missing authorization lets authenticated users escalate privilegesmlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.16.0 MEDIUM6.3MLflow Tracking Server: missing authorization lets users reach protected resourcesmlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.16.0 MEDIUM5.4MLflow: logged-in users can read and cancel other users' jobs on the tracking server (basic-auth)mlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.16.0 HIGH7.8MLflow: crafted pickle evaluation artifact lets remote attacker run codemlflowAI agents & MCP2026-11-04 00:17 UTCby InfraStack Analyst–FIX 3.13.0 MEDIUM6.5MailEnable: XML parsing flaw lets authenticated users read server filesOther2026-11-04 00:17 UTCby NVD–WHAT TO DO MEDIUM5.9MailEnable: mailbox credentials stored in plaintext, readable remotelyOther2026-11-04 00:17 UTCby NVD–WHAT TO DO HIGH8.1libwebsockets: MQTT PUBACK handling lets remote attackers run codeRuntime2026-11-04 00:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8NoMachine nxwebrunner web service: heap overflow lets remote attackers run codeNoMachineOther2026-11-04 00:17 UTCby InfraStack Analyst–FIX 10.1.7 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @touchkey0111/jito-bundle (npm)@touchkey0111/jito-bundlePackage2026-11-04 00:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jito-bundle-jitotip (npm)jito-bundle-jitotipPackage2026-11-04 00:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jito-bundle-jito-tip7 (npm)jito-bundle-jito-tip7Package2026-11-04 00:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jito-bundle-tip-7 (npm)jito-bundle-tip-7Package2026-11-04 00:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jito-bundle-solana (npm)jito-bundle-solanaPackage2026-11-04 00:05 UTCby osv-malicious–UNINSTALL

Tuesday, Nov 3

MEDIUM6.9NocoDB: unauthenticated requests can mint OAuth authorization codesPackage2026-11-02 08:48 UTCby NVD–WHAT TO DO MEDIUM6.3blueprintUE: old account confirmation links still activate accountsOther2026-11-03 17:19 UTCby NVD–WHAT TO DO MEDIUM6.5ZaneOps: workspace admins can read other workspaces' preview environment secretsOther2026-11-03 17:52 UTCby NVD–WHAT TO DO MEDIUM5.4Bagisto: stored XSS via RMA message uploads runs script for adminsPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO LOW2.7RosarioSIS: school admins can bill students of other schoolsPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH8.8RosarioSIS: SQL injection lets logged-in parents read admin password hashesPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH7.1emailflare: authenticated members can send mail from any sender addressPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH8.3emailflare: any member can mint or revoke API keysPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.9SourceHut meta.sr.ht: unauthenticated account registration when public signup is disabledVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH8.7Kore: integer underflow in HTTP body handling exhausts server memoryRuntime2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Umami: Record API endpoint lets remote users bypass authorizationRuntime2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3ArcReel: provider test-connection endpoint allows server-side request forgeryOther2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH7.4Tanium: products trusted certificates from intermediate CAs with compromised keys; fixed in 2025H1 Update 27, 2025H2 Update 17, 2026H1 Update 10TanOSVendor2026-11-03 23:17 UTCby InfraStack Analyst–FIX 1.8.5.0326 MEDIUM6.5MiroTalk P2P: Socket.IO password check flaw allows improper access remotelyPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO LOW3.7MiroTalk P2P: room password check lacks limits on login attemptsPackage2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.5BuildKit: build requests can set extended attributes outside the state directoryInfrastructure2026-11-03 19:25 UTCby NVD–WHAT TO DO HIGH7.2Tanium Deploy: heap buffer overflow lets a user with package-write rights run code; fixed in Deploy 2.36.294 / 2.40.235 / 2.45.322Tanium DeployVendor2026-11-03 23:17 UTCby InfraStack Analyst–FIX 2.36.294 MEDIUM5.3GitHub Enterprise Server: SSH re-key flaw leaks adjacent process memoryRuntime2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Tanium Discover: improper access controls flaw, details unpublishedVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Discover: uncontrolled resource consumption can exhaust a systemVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.2Tanium Discover: improper access controls flaw, impact details unpublishedVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Discover: information disclosure flaw exposes data to attackersVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Discover: information disclosure flaw exposes data to unauthorized usersVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO LOW3.1Tanium Discover: improper access controls flaw, impact details unknownVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Tanium Enforce: improper access controls flaw, details unknownVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Tanium Enforce: improper access controls flaw, details not publishedVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Tanium Threat Response: improper input validation flaw, details unclearVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Threat Response: improper input validation flaw, details unclearVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Threat Response: business logic error with unknown impactVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH7.5Tanium Threat Response: authenticated user can run code on endpoints via SSH Known Hosts sensorThreat ResponseOther2026-11-03 23:17 UTCby InfraStack Analyst–FIX 4.9.480 HIGH7.5Tanium Threat Response: authenticated user can run unauthorized code on endpoints via Linux quarantine packageThreat ResponseVendor2026-11-03 23:17 UTCby InfraStack Analyst–FIX 4.9.480 MEDIUM4.1Tanium Discover: improper output sanitization flaw, details unknownVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM4.3Tanium Threat Response: uncontrolled resource consumption can exhaust the serviceVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-111085 was rejected and withdrawn by its numbering authorityOther2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM5.3GitHub Enterprise Server: CSRF lets attackers delete ChatOps integration credentialsInfrastructure2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH8.4Core Temp: kernel driver lets local users read or write physical memoryCore TempInfrastructure2026-11-03 23:17 UTCby InfraStack Analyst–FIX 1.21 NOT SCOREDNOT SCOREDCVE-2026-108516 was rejected and withdrawn by its numbering authorityOther2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM5.0Tanium Data Service: path traversal flaw reported, details limitedVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO MEDIUM6.5Tanium Client: denial of service flaw, details not yet publishedVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-107916 was rejected and withdrawn by its numbering authorityOther2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH7.7GitHub Enterprise Server: SSH-authenticated users can run commands via Git serviceVendor2026-11-03 23:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-103429 was rejected and withdrawn by its numbering authorityOther2026-11-03 23:17 UTCby NVD–WHAT TO DO HIGH8.7Emerson Ovation: firmware updates accepted without signature checks, enabling malicious firmwareOvationInfrastructure2026-11-03 23:17 UTCby InfraStack Analyst–FIX 3.8.0 Feature Pack 3 CRITICAL9.8Emerson Ovation: unauthenticated protocols let attackers change controller configurationOvationInfrastructure2026-11-03 23:17 UTCby InfraStack Analyst–FIX 3.8.0 Feature Pack 3 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in arbkit (npm)arbkitPackage2026-11-03 22:56 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ln9qw38745g (PyPI)ln9qw38745gPackage2026-11-03 22:54 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: MMS Delivery Receipt Delays from a Subset of Twilio Long Codes to Multiple Networks in United StatesTwilioVendor2026-11-03 22:51 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in protecteda (PyPI)protectedaPackage2026-11-03 22:50 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in txnforge (npm)txnforgePackage2026-11-03 22:31 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in print-hello-world-test-temp (npm)print-hello-world-test-tempPackage2026-11-03 22:31 UTCby osv-malicious–UNINSTALL MEDIUM6.9StorageGRID: unauthenticated attacker reaches internal-only grid APIs by defaultInfrastructure2026-11-03 22:19 UTCby NVD–WHAT TO DO CRITICAL9.1NetApp StorageGRID: authentication bypass lets attackers with Grid Network access make unauthorized requestsInfrastructure2026-11-03 22:19 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Docker Sandboxes: repository Git config can run host programs outside isolationOther2026-11-03 22:19 UTCby NVD–WHAT TO DO LOW1.8Docker Buildx: untrusted Bake files can read sibling paths without approvalPackage2026-11-03 19:26 UTCby NVD–WHAT TO DO MEDIUM5.6Docker Buildx: untrusted Bake files can read host files without approvalPackage2026-11-03 19:27 UTCby NVD–WHAT TO DO MEDIUM6.5Umami: login route can skip two-factor authentication under certain conditionsPackage2026-11-03 22:19 UTCby NVD–WHAT TO DO HIGH7.5School-Management-System: SQL injection through the public search email fieldSchool-Management-SystemPackage2026-11-03 22:19 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.7BuildKit: a build definition can crash the build daemon via Git metadataInfrastructure2026-11-03 19:24 UTCby NVD–WHAT TO DO CRITICAL9.6Chrome on Android: WebGL memory write lets crafted page run codeOther2026-11-03 22:19 UTCby NVD–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: incorrect authorization lets a crafted web page bypass origin policyRuntime2026-11-03 22:19 UTCby NVD–WHAT TO DO CRITICAL9.2Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before…Package2026-11-03 21:11 UTCby Vendor & lab pages–WHAT TO DO HIGH7.3TP-Link Archer AX3000 v2: admin can run commands via USB download pathArcher AX3000 v2Infrastructure2026-11-03 22:19 UTCby InfraStack Analyst–FIX 1.1.3 Build 261026 HIGH7.2HumHub: stored XSS in friendship dialog via first/last name, fixed in 1.18.7 and 1.19.1humhubPackage2026-10-26 14:41 UTCby InfraStack Analyst–FIX 1.18.7 MEDIUMCAMPAIGNFUNDS STOLENAtlasCorePolyFuckedFake Polymarket and Kalshi prediction-market sites, promoted by AI-made influencers on Instagram, take crypto deposits and ID documents and never let victims withdraw (Recorded Future)PolymarketOther2026-11-03by InfraStack Analyst–WHAT TO DO MEDIUMCAMPAIGNDATA EXPOSEDWorkOS breachWorkOS breached: attacker using the ARTEX AI framework got into an internal sales app and took customer contacts, account histories and sales/support call summariesWorkOSVendor2026-11-03 21:28 UTCby InfraStack Analyst–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDAttackers sign in to Microsoft Entra ID and Azure DevOps as app service principals using stolen client secrets, hitting MSPs and their customer tenants to loot Key Vault and files (Todyl, Huntress)Microsoft Entra IDInfrastructure2026-11-03by InfraStack Analyst–WHAT TO DO CRITICAL9.8Etrel INCH AC charger web panel ships with hard-coded admin loginInfrastructure2026-11-03 22:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDCVE-2026-119084 - Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection ParametersPackage2026-11-03 21:58 UTCby Vendor & lab pages–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zyto (PyPI)zytoPackage2026-11-03 21:46 UTCby osv-malicious–UNINSTALL CRITICAL9.1node-opcua: namespace access defaults ignored, anonymous clients can write variablesPackage2026-10-23 05:49 UTCby NVD–WHAT TO DO MEDIUM6.8Dell Wyse Management Suite: cross-site scripting lets a low-privilege user inject scriptsVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO LOW3.3Dell Wyse Management Suite: cross-site scripting flaw lets local users inject scriptInfrastructure2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH8.8Dell Wyse Management Suite: cross-site scripting lets a low-privileged user inject scriptVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICAL9.0Dell Wyse Management Suite: cross-site scripting lets a low-privilege user inject scriptsVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH7.8Dell OS Recovery Tool: untrusted search path lets local attacker run commandsVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO LOW2.4Dell OS Recovery tool: hard-coded cryptographic key lets physical attacker read dataInfrastructure2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUM5.2TinyUSB: crafted USB device triggers out-of-bounds read and denial of serviceRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-61496 was rejected and withdrawn by its numbering authorityOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH7.0TinyUSB: MTP string parsing lets a USB host overwrite memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-28531 was rejected and withdrawn by its numbering authorityOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH8.8Argo CD Image Updater: proxy URL setting lets an attacker run shell commandsargocd-image-updaterInfrastructure2026-10-07 15:58 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDDevolutions Server: Jira filter lookup leaks stored service account credentialsVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUM5.1IrfanView: TIFF Wang Annotation handler heap overflow allows remote attackPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUM6.5ZenTao PMS: user group change flaw allows improper privilege escalation remotelyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUM5.5WordPress Headless CMS Plugin: REST API leaks post data to remote callersPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH7.5CloudClassroom-PHP-Project: SQL injection in faculty details page via deleteidCloudClassroom-PHP-ProjectPackage2026-11-03 21:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDChrome: use-after-free in tab strip lets crafted extension run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: GPU use-after-free lets a compromised renderer escape its sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: Autofill AI flaw lets a crafted web page read cross-origin dataOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted web page leaks sensitive data through the Select elementRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: DevTools flaw lets a crafted extension bypass site isolationRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: crafted HTML page bypasses web origin policyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: V8 authorization gap lets a crafted page bypass web origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: extension use-after-free lets a crafted extension escape the sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: ANGLE buffer overflow lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: API authorization flaw lets crafted extension bypass system access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome on Android: Dawn buffer overflow lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome on Android: WebGL use-after-free lets a crafted page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: autofill race condition can leak sensitive data from crafted pagesRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: FileAPI UI spoofing lets a crafted page fake browser promptsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: crafted web page can leak sensitive information from FramesRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: WebPackaging input validation lets remote sites bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Android: use-after-free in navigation lets a web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted network traffic can bypass system access restrictionsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted web page leaks cross-origin data to remote attackersRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: use-after-free lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: crafted web page bypasses file access restrictionsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: input validation flaw lets crafted page bypass web origin policyVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page can leak sensitive data from PaintRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on Android: Contacts flaw lets a crafted web page escape sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: CacheStorage type confusion lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: incorrect authorization lets a local app read sensitive informationRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: DevTools authorization flaw lets a crafted web page bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: ANGLE race condition lets a crafted web page escape the sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome on Android: memory bug in ANGLE lets crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: Skia uninitialized memory lets a compromised renderer read memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: permissions check lets a crafted web page bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDGoogle Chrome on Mac: sandbox escape via crafted network trafficOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: media timing discrepancy lets a web page leak cross-origin dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page bypasses origin policy in FormsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: compromised renderer can bypass system access restrictions via crafted HTMLRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: GPU integer overflow lets a compromised renderer escape its sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: V8 type confusion lets a crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: streaming use-after-free lets nearby attacker run code in sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: UI spoofing via crafted HTML page before 157.0.8103.38Package2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: Bluetooth UI can be spoofed by a crafted web pageOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Passwords lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: uninitialized image resource leaks cross-origin data from crafted pagesPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: incorrect authorization lets a crafted page bypass web origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in PowerBookmarks lets a crafted extension run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted HTML page can spoof the address barRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: out-of-bounds read in Media lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Mac: uninitialized GPU memory lets a web page read dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted page could spoof browser UI elements via social engineeringRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: CORS authorization flaw lets a crafted page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: incomplete DevTools cleanup lets a web page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome: use-after-free in Geometry lets crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: Autofill use-after-free lets a crafted page escape the sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Animation lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: DevTools reference flaw lets a crafted page escape the sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome on Mac: Chromoting flaw lets a local program read sensitive dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: WebUI confused deputy lets crafted page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Mac: out-of-bounds read lets a web page read memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on iOS: crafted web page bypasses restrictions into privileged pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: Trusted Types flaw lets a crafted page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: a compromised renderer can read data via crafted PDFOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: extension authorization flaw lets a crafted extension bypass system access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted extension can spoof browser UI elementsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: use-after-free in browser lets a crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in PerformanceAPIs lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: Paint flaw lets a crafted web page leak sensitive informationRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on iOS: crafted page can spoof Passwords dialog elementsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Picture-in-Picture lets crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: media out-of-bounds read lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: extension authorization flaw lets a compromised renderer escape the sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in DOM lets a web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Editing lets a crafted page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: media buffer overflow lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: PDFium use-after-free lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Aura lets a compromised renderer escape sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on iOS: PageInfo UI can be spoofed by a crafted pageOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: uninitialized memory in Media lets a web page read sandbox memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page can bypass site isolation protectionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: missing authorization in BackgroundFetch lets a web page bypass origin policyOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: WebGL uninitialized memory lets a crafted web page read memoryPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page can spoof browser UI elementsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: DevTools confused deputy lets a crafted page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: WebCodecs flaw lets a crafted web page bypass origin policyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: DevTools flaw lets a crafted extension bypass web origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome DevTools: crafted HTML page can run code inside the browser sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: permissions check lets a compromised renderer bypass system access limitsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: PDFium type confusion lets a crafted PDF run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome on Android: crafted page can spoof interface elementsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on Mac: flawed Views authorization lets crafted pages bypass access limitsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: input validation flaw lets a compromised renderer escape sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome on Windows: notification UI can be spoofed by a crafted pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: BackgroundFetch flaw leaks cross-origin data from a crafted pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: Skia out-of-bounds read lets a crafted web page leak memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: History flaw lets a crafted web page bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted web page leaks sensitive data through Paint componentRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: Chromoting flaw lets a local program bypass access restrictionsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome: Dawn buffer overflow lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: ANGLE use-after-free lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: uninitialized GPU memory lets a compromised renderer read outside sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: network authorization flaw lets a crafted extension bypass web origin policyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted HTML page bypasses web origin policy via editingRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: out-of-bounds read lets a compromised renderer escape the sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: CORS discrepancy lets a crafted web page read cross-origin dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: DevTools type confusion lets a crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: DevTools missing authorization lets remote attacker bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted web page bypasses web origin policy before 157.0.8103.38Runtime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: BackgroundFetch information loss lets a web page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Mac: image handling flaw lets a compromised renderer escape sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: V8 flaw lets a crafted web page read cross-origin dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome for Android: use-after-free lets a crafted extension run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: form observable discrepancy leaks sensitive data from crafted pagesPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: WebRTC use-after-free lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: use-after-free in scheduling lets a crafted page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: WebAudio use-after-free lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome: use-after-free in Core lets a crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: ServiceWorker flaw leaks data to an attacker who already controls the rendererOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: XML coding flaw lets a crafted web page run code in sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Canvas lets crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted page can spoof Prompts dialog elements via social engineeringRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: PageInfo dialog can be spoofed by a crafted web pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: Prerender input flaw lets a compromised renderer bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Controls lets a crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: SVG use-after-free lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Paint lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on Android: WebView authorization gap leaks data from crafted pagesRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: Shopping feature lets remote attackers bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in TabStrip lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: PDFium buffer overflow lets a crafted PDF run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: out-of-bounds read in Permissions lets a compromised renderer escapeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: HID authorization flaw lets a crafted web page bypass access restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome for Android: Shopping UI can be spoofed by a crafted pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: weak SSL encryption lets remote attacker bypass web origin policyOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: BackgroundFetch confused deputy lets a web page bypass origin policyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: background fetch authorization flaw lets a web page bypass origin policyOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome for Android: Omnibox flaw leaks sensitive information to remote attackersRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: network flaw lets a crafted web page read cross-origin dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: FileSystem authorization flaw lets crafted page escape sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: extension authorization flaw lets a site read cross-origin dataPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: BackgroundFetch flaw lets a crafted web page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: DevTools flaw lets a crafted extension reach privileged pagesPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in DOM lets a crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: PrivateTokens flaw leaks sensitive data via crafted web pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: GPU state flaw lets a compromised renderer escape the sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: printing use-after-free lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: incomplete V8 cleanup lets a local program read memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: uninitialized WebGL memory lets a web page read dataPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: out-of-bounds read in Animation lets a web page read sandbox memoryOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted SVG page can crash or misbehave through recursionOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: flawed permission checks let a compromised renderer read dataOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on iOS: navigation flaw lets a compromised renderer escape sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: WebGPU use-after-free lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: missing permission check in PerformanceAPIs leaks cross-origin dataRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome for Android: crafted page bypasses web origin policy, fixed in 157Package2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: Skia buffer overflow lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page bypasses access limits on privileged pagesPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: Skia out-of-bounds read lets a compromised renderer escape sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in compositing lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: password manager UI misrepresentation leaks sensitive data via social engineeringRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: codec use-after-free lets a crafted web page read sandbox memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 race condition lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome for Android: use-after-free lets a crafted page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: WebXR use-after-free lets a crafted page run code outside the sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: DevTools flaw lets a crafted web page bypass access restrictionsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Android: GPU memory corruption lets a crafted page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: use-after-free in network stack allows code execution outside sandboxRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: uninitialized Skia memory lets a crafted page read cross-origin dataPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: incorrect authorization in FileSystem lets a crafted page escape sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: use-after-free in WTF lets a crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: use-after-free in Track lets a web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: crafted page can spoof permission prompt UI elementsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: extension authorization flaw lets a crafted extension bypass access limitsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: DevTools authorization flaw lets crafted pages bypass origin policyPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: input validation flaw lets local program escape sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: CacheStorage authorization flaw lets compromised renderer bypass site isolationOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: flawed API authorization lets a compromised renderer bypass system restrictionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free lets a crafted web page run code in sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: FileSystem authorization flaw lets crafted pages run code outside sandboxPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: crafted HTML page leaks cross-origin data to remote attackersRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: V8 type confusion lets a crafted web page run codeOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: DevTools cleanup flaw lets a crafted extension bypass access limitsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: XML state validation flaw lets a web page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome on Android: spoofed Transactions UI via crafted HTML pageOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: GPU use-after-free lets a crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on iOS: crafted page can spoof the address barRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome on iOS: race condition lets crafted web page bypass origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: V8 out-of-bounds read lets a local attacker read memoryRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: V8 race condition lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: media buffer overflow lets a crafted web page run codeRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: web app install flaw lets a crafted page spoof the address barRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome on Mac: crafted page can spoof browser UI elementsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in Layout lets a crafted page run codeVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: payments UI can be spoofed by a crafted web pagePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on Android: permissions check lets a web page bypass access restrictionsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGoogle Chrome: missing access check lets a web page read sensitive dataPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: compromised renderer can bypass system access restrictions via crafted pageRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: proxy authentication flaw lets nearby attacker obtain sensitive informationOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDGoogle Chrome: compositing flaw leaks cross-origin data from crafted pagesOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Windows: ANGLE memory write flaw lets crafted pages run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: use-after-free in CSS lets a crafted page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO CRITICALNOT SCOREDChrome: use-after-free in Prerender lets a web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome on Windows: use-after-free lets crafted web page run codePackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome on Android: uninitialized GPU memory lets a compromised renderer read memoryOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDChrome: Skia out-of-bounds read lets a crafted web page leak memoryPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDChrome: PDF viewer flaw lets a crafted extension bypass web origin policyRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGoogle Chrome: DevTools authorization flaw lets crafted page escape sandboxOther2026-11-03 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDChrome: crafted web page can bypass site isolation protectionsRuntime2026-11-03 21:17 UTCby NVD–WHAT TO DO LOW3.7MongoDB Atlas SQL ODBC Driver: memory overflow when reading query resultsOther2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGH7.1MongoDB Atlas SQL ODBC Driver: out-of-bounds write can corrupt client memory and crash appsPackage2026-11-03 21:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: email test leaks stored SMTP password to attacker hostOther2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: TOTP secrets stored unencrypted in account dataVendor2026-11-03 21:17 UTCby NVD–WHAT TO DO HIGHNOT SCOREDDevolutions Server: identity sync API leaks other users' MFA secretsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: AD credential check leaks service account NetNTLMv2 hashInfrastructure2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDDevolutions Server: expired PAM checkouts keep account access after checkout endsPackage2026-11-03 21:17 UTCby NVD–WHAT TO DO MEDIUM6.3Effect: cookie name and path fields let callers inject Set-Cookie attributesPackage2026-10-30 05:04 UTCby NVD–WHAT TO DO CRITICAL9.0Puppet Server and OpenVox: certificate name matching lets a client impersonate other nodesopenvox-serverRuntime2026-11-03 21:17 UTCby InfraStack Analyst–FIX 8.18.0 CRITICAL9.4Puppet Server: crafted report lets an agent certificate run code on the serverpuppet-coreInfrastructure2026-11-03 21:17 UTCby InfraStack Analyst–FIX 9.1.3 MEDIUMCAMPAIGNFake iCollections for macOS download site on GitHub Pages (icollections.github[.]io) serves a malicious DMGiCollectionsOther2026-11-03 19:56 UTCby InfraStack Analyst–WHAT TO DO MEDIUMINCIDENTGitHub: Incident with Git OperationsGitHubVendor2026-11-03 20:57 UTCby status page–WHAT TO DO HIGH7.8Stanza: RCE via pickle deserialization in the lemmatizerstanzaPackage2026-10-01 05:55 UTCby GitHub Advisories–FIX 1.15.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in hijuko-pilara (PyPI)hijuko-pilaraPackage2026-11-03 20:19 UTCby osv-malicious–UNINSTALL LOW3.1HPE Networking Fabric Composer: management interface leaks sensitive information to low-privileged usersInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO LOW3.1HPE Networking Fabric Composer: API path traversal lets low-privilege users read filesInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO LOW3.3HPE Fabric Composer: local user can read some OS filesInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO LOW3.7HPE Networking Fabric Composer: sensitive information disclosure without loginInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO LOW3.8HPE Networking Fabric Composer: local low-privilege user can cause partial denial of serviceInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM4.2HPE Networking Fabric Composer: API race condition lets low-privilege users corrupt configurationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM4.3HPE Networking Fabric Composer: API endpoint leaks system information to logged-in usersInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM4.7HPE Networking Fabric Composer: OS flaw leaks sensitive information to local usersInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.3HPE Networking Fabric Composer: API lets attackers forge audit log client addressesInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.3HPE Networking Fabric Composer: API flaw lets low-privilege users read sensitive dataInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.3HPE Fabric Composer API leaks sensitive system information without authenticationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.3HPE Networking Fabric Composer: sensitive data disclosure to low-privilege accountsInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.4HPE Networking Fabric Composer: web management interface leaks sensitive informationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.7HPE Networking Fabric Composer: API certificate validation flaw exposes sensitive informationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.9HPE Networking Fabric Composer: certificate check flaw exposes transferred files and credentialsInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.9HPE Networking Fabric Composer: API sessions may not expire, keeping admin accessInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.9HPE Networking Fabric Composer: improper certificate validation leaks sensitive informationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.4HPE Networking Fabric Composer: API flaw lets low-privilege users gain higher accessInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.5HPE Networking Fabric Composer: API flaw lets users hide their audit recordsInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.5HPE Networking Fabric Composer: API authorization bypass lets users change protected resourcesInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.5HPE Networking Fabric Composer: local API auth bypass lets low-privilege users write filesInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.6HPE Networking Fabric Composer: API command injection lets admins escalate to the OSInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.8HPE Networking Fabric Composer: certificate validation flaw exposes management trafficInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO HIGH7.1HPE Fabric Composer API flaw lets a low-privilege user view network traffic from managed switchesfabric-composerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH7.1HPE Networking Fabric Composer: local user can gain higher privilegesFabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.4.1 HIGH7.4HPE Networking Fabric Composer: API certificate check flaw lets attackers bypass loginInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Networking Fabric Composer: improper certificate validation exposes credentials to attackersInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Networking Fabric Composer: missing integrity check lets remote attackers run codeInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Networking Fabric Composer: SQL injection lets an attacker run database commandsfabric-composerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH7.5HPE Networking Fabric Composer: SSH flaw lets low-privilege users gain higher accessInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Networking Fabric Composer: API authentication bypass lets unauthenticated adjacent attackers inInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Fabric Composer API: unauthenticated attacker can take management services offlineInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7HPE Networking Fabric Composer: information disclosure lets an attacker intercept trafficInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8HPE Networking Fabric Composer: local attacker gains elevated privileges on OSInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8HPE Networking Fabric Composer: local users can overwrite arbitrary system filesInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.0HPE Networking Fabric Composer: API missing integrity verification lets low-privilege users gain elevated privilegesHPE Networking Fabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH8.0HPE Networking Fabric Composer: improper certificate checks let attackers intercept trafficInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.1HPE Networking Fabric Composer: API lets attackers brute-force accounts into adminInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.1HPE Networking Fabric Composer: remote authentication bypass can give admin access (fixed in 7.3.5 and 7.4.1)Fabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH8.2HPE Networking Fabric Composer: local privilege escalation on underlying host OSHPE Networking Fabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH8.3HPE Networking Fabric Composer: certificate validation flaw lets attackers intercept dataFabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 HIGH8.7HPE Networking Fabric Composer: certificate validation flaw can expose credentialsHPE Networking Fabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8HPE Fabric Composer API lets low-privilege users read stored credentialsFabric ComposerInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 7.3.5 CRITICAL9.6HPE Networking Fabric Composer: unauthenticated adjacent attacker can run codeInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.6HPE Fabric Composer: authentication bypass in operating system allows code executionInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8HPE Networking Fabric Composer: hardcoded passwords give remote attackers admin accessInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5HPE Networking VIA: buffer overflow lets a local user crash the systemInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.5HPE Networking VIA: authenticated users can read sensitive informationInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO HIGH7.1HPE Networking VIA client for Linux: arbitrary file write lets local users escalate privileges (fixed in 4.7.9)VIA clientOther2026-11-03 20:18 UTCby InfraStack Analyst–FIX 4.7.9 HIGH7.2HPE Networking VIA: admin command injection grants elevated OS command executionInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5HPE Networking VIA: buffer overflow lets unauthenticated attacker crash clientVIA clientInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–FIX 4.7.9 HIGH7.8HPE Networking VIA client for Linux: command injection lets local users run commands with elevated privileges (fixed in 4.7.9)VIA clientOther2026-11-03 20:18 UTCby InfraStack Analyst–FIX 4.7.9 HIGH8.1HPE VIA: improper certificate validation lets remote attackers bypass authenticationInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4HPE Networking VIA client: missing integrity verification allows local privilege escalationOther2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Virtual Intranet Access client: local users can gain elevated system privilegesInfrastructure2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.3Docker Buildx: bake build can skip entitlement consent, reaching outside the working directorygithub.com/docker/buildxPackage2026-09-30 18:48 UTCby InfraStack Analyst–FIX 0.37.2 HIGH7.7Claude Code: Edit tool symlink race lets sandboxed code overwrite files outside workspaceAI agents & MCP2026-10-26 11:43 UTCby NVD–WHAT TO DO HIGH7.5Claude Desktop on Windows runs a planted git.exe from opened repositoriesAI agents & MCP2026-10-13 12:24 UTCby NVD–WHAT TO DO HIGH8.3Yeti: export task name lets authenticated users read and write arbitrary filesPackage2026-07-01 14:36 UTCby NVD–WHAT TO DO HIGH7.5ag-psd: crafted Photoshop files exhaust memory and crash parsingPackage2026-07-01 14:15 UTCby NVD–WHAT TO DO HIGH7.1Yeti: crafted DFIQ UUID lets authenticated users write files outside archivePackage2026-07-01 14:09 UTCby NVD–WHAT TO DO HIGH7.6Yeti: low-privileged users can inject ArangoDB queries through search endpointsyetiPackage2026-07-01 12:26 UTCby InfraStack Analyst–FIX 2.5.1 HIGH7.5Yeti: unauthenticated audit timeline endpoint leaks analyst activity recordsPackage2026-07-01 12:04 UTCby NVD–WHAT TO DO MEDIUM5.3isomorphic-git: crafted tree entries let a clone write files outside the projectPackage2026-07-01 11:16 UTCby NVD–WHAT TO DO MEDIUM4.3isomorphic-git: malicious remote can force 2 GB memory allocation during clonePackage2026-07-01 11:16 UTCby NVD–WHAT TO DO MEDIUM4.3isomorphic-git: circular symrefs from a remote hang repository operationsPackage2026-07-01 11:15 UTCby NVD–WHAT TO DO CRITICAL9.3fastapi-code-generator: crafted OpenAPI path injects Python code into generated appsPackage2026-07-01 09:45 UTCby NVD–WHAT TO DO CRITICAL9.3fastapi-code-generator: OpenAPI summaries inject Python code into generated handlersPackage2026-07-01 09:45 UTCby NVD–WHAT TO DO CRITICAL9.3fastapi-code-generator: crafted OpenAPI response key injects Python codePackage2026-07-01 09:46 UTCby NVD–WHAT TO DO MEDIUM4.3MyTube: visitors can forge statistics events and skew analyticsPackage2026-07-01 05:03 UTCby NVD–WHAT TO DO MEDIUM6.8MyTube: CSRF check skipped for any x-api-key header, enabling admin actionsPackage2026-07-01 05:03 UTCby NVD–WHAT TO DO HIGH8.8isomorphic-git: checkout follows symlinks and writes files outside the working treePackage2026-07-01 11:10 UTCby NVD–WHAT TO DO HIGH8.1Network UPS Tools: upsmon alarm text lets a server run OS commandsInfrastructure2026-07-01 15:27 UTCby NVD–WHAT TO DO HIGH7.2Chamilo LMS: admin search parameter lets SQL injection read and change dataPackage2026-07-01 09:59 UTCby NVD–WHAT TO DO MEDIUM6.7whatstk: crafted WhatsApp chat export can hang the parserPackage2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM5.4MongoDB EF Core provider: caller input alters fields in bulk updatesPackage2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.3Elixir ash_authentication: password change leaves old session tokens validPackage2026-11-03 18:57 UTCby NVD–WHAT TO DO HIGH8.3Tapo Cloud MQTT proxy: unvalidated host value enables server-side request forgeryVendor2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.3Tapo Cloud: broken access control lets one device write to another's storageVendor2026-11-03 20:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1Vembu BDRSuite: unauthenticated XSS via restore progress page parametersInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO MEDIUM6.1Vembu BDRSuite: unauthenticated cross-site scripting in backup progress pageInfrastructure2026-11-03 20:18 UTCby NVD–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDmSecure password manager incident: maker mSeven tells customers to change stored passwords, reset 2FA and remove passkeys after 'suspicious activity'; vault exposure unknownmSecureVendor2026-11-03by InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDCVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingPackage2026-11-03 19:36 UTCby Vendor & lab pages–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in filipt (PyPI)filiptPackage2026-11-03 19:28 UTCby osv-malicious–UNINSTALL HIGH7.1OpenShift bare metal provisioning: unauthenticated image server leaks cluster pull secretInfrastructure2026-11-03 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.2Logging Redactor: custom __str__ and __repr__ output leaks personal data into logsPackage2026-07-01 05:39 UTCby NVD–WHAT TO DO HIGH7.3traQ: silent OAuth2 consent check lets clients gain broader scopesRuntime2026-07-01 11:20 UTCby NVD–WHAT TO DO HIGH7.3traQ: uploaded SVG or HTML files run script in victims' browsersOther2026-07-01 11:20 UTCby NVD–WHAT TO DO HIGH8.1OPNsense: line injection in settings lets delegated users alter privileged configsOther2026-07-01 13:29 UTCby NVD–WHAT TO DO HIGH7.5GeoNetwork: search proxy skips access filters, exposing hidden metadata recordsPackage2026-07-01 11:06 UTCby NVD–WHAT TO DO HIGH7.1GeoNetwork: crafted link runs JavaScript in logged-in admin's browser sessionPackage2026-07-01 11:05 UTCby NVD–WHAT TO DO MEDIUM5.4Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…Package2026-11-03 18:43 UTCby Vendor & lab pages–WHAT TO DO HIGH7.5CloudClassroom-PHP-Project: login page allows session fixation via PHPSESSIDPackage2026-11-03 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Netcore NBR100V2 router: integer overflow in msg_aes_dec allows remote attackNBR100V2Infrastructure2026-11-03 19:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1MongoDB C Driver: malformed server namespace field crashes client and leaks heap memorylibmongocPackage2026-11-03 19:18 UTCby InfraStack Analyst–FIX 1.30.15 HIGH8.7MongoDB C Driver: mongoc_gridfs_bucket_download_to_stream can abort the process on invalid GridFS file metadatamongo-c-driver (libmongoc)Package2026-11-03 19:18 UTCby InfraStack Analyst–FIX 1.30.15 MEDIUM6.3BSON library: vector data arithmetic wraparound on 32-bit builds corrupts parsed resultsPackage2026-11-03 19:18 UTCby NVD–WHAT TO DO MEDIUM5.1Atlas SQL JDBC Driver: sign-in flow opens attacker-chosen addresses on user's systemPackage2026-11-03 19:18 UTCby NVD–WHAT TO DO MEDIUM6.5MongoDB C Driver: uninitialized memory can leak into GridFS stored filesPackage2026-11-03 19:18 UTCby NVD–WHAT TO DO HIGH8.7MongoDB C Driver: compressed responses leak memory, exhausting client applicationslibmongocPackage2026-11-03 19:17 UTCby InfraStack Analyst–FIX 2.5.8 MEDIUM6.8MongoDB Rust Driver: tracing can log fields meant for encryptionPackage2026-11-03 19:17 UTCby NVD–WHAT TO DO HIGH8.8Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…Package2026-11-03 18:19 UTCby Vendor & lab pages–WHAT TO DO CRITICAL9.2Docker Desktop on Windows: container escapes seccomp to reach host filesDocker Desktop (WSL 2 backend, Windows, x86-64)Runtime2026-11-03 19:17 UTCby InfraStack Analyst–FIX 4.98.0 with WSL 3.0.3 HIGHNOT SCOREDCVE-2026-119085 - Template injection in the publishing component of Virtual Engineering WorkbenchOther2026-11-02 17:41 UTCby Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-119922 - Babelfish for PostgreSQL Privilege EscalationRuntime2026-11-03 18:26 UTCby Vendor & lab pages–WHAT TO DO LOWINCIDENTCloudflare: Missing Logs and Traces in Cloudflare Observability PlatformCloudflareVendor2026-11-03 18:40 UTCby status page–WHAT TO DO MEDIUM6.9zt-zip: crafted ZIP entries can overwrite extraction directory permissionsPackage2026-07-01 13:51 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDDuplicate CVE entry rejected; no product flaw describedOther2026-11-03 18:18 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDDuplicate CVE entry rejected; no vulnerability described hereOther2026-11-03 18:18 UTCby NVD–WHAT TO DO MEDIUM6.1zt-zip: Zips fluent unpack API allows writing files outside destinationPackage2026-07-01 06:21 UTCby NVD–WHAT TO DO HIGH7.0Monitoring Plugins: check_icmp heap overflow can escalate local privilegesPackage2026-07-01 12:39 UTCby NVD–WHAT TO DO MEDIUM6.3Bagisto: race condition lets shoppers reuse single-use coupons repeatedlyPackage2026-11-03 18:17 UTCby NVD–WHAT TO DO MEDIUM6.1buku: stored cross-site scripting in bookmark list via unescaped URLPackage2026-11-03 18:17 UTCby NVD–WHAT TO DO MEDIUM6.3GNU Gatekeeper: short probe packet causes heap over-read and possible crashInfrastructure2026-11-03 18:17 UTCby NVD–WHAT TO DO MEDIUM6.3GNU Gatekeeper: malformed RTCP packet reads heap memory and can crash gatekeeperRuntime2026-11-03 18:17 UTCby NVD–WHAT TO DO HIGH7.6Nanosystems Supremo: improper certificate checks let network attackers read loginsOther2026-11-03 18:17 UTCby NVD–WHAT TO DO MEDIUM6.5phpMyAdmin MoTranslator: locale argument allows path traversal from remotePackage2026-11-03 18:17 UTCby NVD–WHAT TO DO MEDIUM5.4NetBox: broken access control lets users create components on out-of-scope devicesPackage2026-11-03 18:17 UTCby NVD–WHAT TO DO CRITICAL9.8Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access@enspirit/eloPackage2026-10-30 17:22 UTCby GitHub Advisories–FIX 1.0.1 CRITICAL9.8Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels@enspirit/eloPackage2026-10-30 17:23 UTCby GitHub Advisories–FIX 1.0.1 HIGH7.4Elo backends have code injection via unvalidated emission of programmatic AST fields@enspirit/eloPackage2026-10-30 17:23 UTCby GitHub Advisories–FIX 1.0.1 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in bznio5 (npm)bznio5Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in v36sl2 (npm)v36sl2Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in g3ypjg (npm)g3ypjgPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ru0z83 (npm)ru0z83Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in gvmabc (npm)gvmabcPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jd7ijw (npm)jd7ijwPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in j4pe0w (npm)j4pe0wPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ll3zea (npm)ll3zeaPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in s775oe (npm)s775oePackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 2tyegs (npm)2tyegsPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in t6unrv (npm)t6unrvPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 3zqth8 (npm)3zqth8Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in rtvu6h (npm)rtvu6hPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in kojs0k (npm)kojs0kPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ib3rwn (npm)ib3rwnPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in qxjf8r (npm)qxjf8rPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in wyrj3i (npm)wyrj3iPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 5df897 (npm)5df897Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in wolce9 (npm)wolce9Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sgj0kx (npm)sgj0kxPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in y0syoh (npm)y0syohPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in wxmzfq (npm)wxmzfqPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 7un7kh (npm)7un7khPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc (npm)gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvcPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f (npm)latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42fPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in updated-today-gen-photo-lab-pro-h-a-c-k-gen-erat-or-ofgpju (npm)updated-today-gen-photo-lab-pro-h-a-c-k-gen-erat-or-ofgpjuPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in more-resour-ces-gen-stickman-legends-f-r-e-e-h-a-c-k-gen-erat-or-bv4n15 (npm)more-resour-ces-gen-stickman-legends-f-r-e-e-h-a-c-k-gen-erat-or-bv4n15Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in working-today--empire-takeover-h-a-c-k-gen-erat-or-akcp8z (npm)working-today--empire-takeover-h-a-c-k-gen-erat-or-akcp8zPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5 (npm)gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxl (npm)more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxlPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in j5ugvu (npm)j5ugvuPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in k7nhgj (npm)k7nhgjPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in new-code-unlim-ited-my-time-at-portia-h-a-c-k-gen-erat-or-i477p4 (npm)new-code-unlim-ited-my-time-at-portia-h-a-c-k-gen-erat-or-i477p4Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in updated-today-gen-dr-parking-4-h-a-c-k-gen-erat-or-hmdcsa (npm)updated-today-gen-dr-parking-4-h-a-c-k-gen-erat-or-hmdcsaPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in yhk9j0 (npm)yhk9j0Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in updated-gen-erator-rainbow-six-mobile-h-a-c-k-gen-erat-or-1179lh (npm)updated-gen-erator-rainbow-six-mobile-h-a-c-k-gen-erat-or-1179lhPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294 (npm)real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in new-code-unlim-ited-jurassic-world-m-od-f-r-e-e-wuo1ky (npm)new-code-unlim-ited-jurassic-world-m-od-f-r-e-e-wuo1kyPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6 (npm)more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in updated-gen-erator-producer-h-a-c-k-gen-erat-or-g8pi55 (npm)updated-gen-erator-producer-h-a-c-k-gen-erat-or-g8pi55Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in winjb6 (npm)winjb6Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in l52upm (npm)l52upmPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 1b67v5 (npm)1b67v5Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in 9ct8bi (npm)9ct8biPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in more-resour-ces-gen-tailed-demon-slayer-h-a-c-k-gen-erat-or-yas2jz (npm)more-resour-ces-gen-tailed-demon-slayer-h-a-c-k-gen-erat-or-yas2jzPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in u0bh1f (npm)u0bh1fPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in code-resour-ces-new-app-cloner-premium-9upyk2 (npm)code-resour-ces-new-app-cloner-premium-9upyk2Package2026-11-03 17:35 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v (npm)updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7vPackage2026-11-03 17:35 UTCby osv-malicious–UNINSTALL HIGH8.1Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityMicrosoft.DotNet.ILCompilerRuntime2026-11-03 17:33 UTCby GitHub Advisories–FIX 8.0.33 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @shein-risk/si_verify (npm)@shein-risk/si_verifyPackage2026-11-03 17:26 UTCby osv-malicious–UNINSTALL MEDIUM4.3myCred WordPress plugin: missing authorization check exposes access controlPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM4.3WCFM Membership WordPress plugin: missing authorization check, versions through 2.12.0Package2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3WCFM Membership WordPress plugin: missing authorization check exposes access controlsPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO HIGHNOT SCOREDgohttpserver: hardcoded session key lets attackers forge login cookiescodeskyblue/gohttpserverPackage2026-11-03 17:18 UTCby InfraStack Analyst–WHAT TO DO HIGHNOT SCOREDgohttpserver: crafted zip upload writes arbitrary files to diskgohttpserver1 talkingOther2026-11-03 17:18 UTCby InfraStack Analyst1talkingWHAT TO DO NOT SCOREDNOT SCOREDim3x Scriptables: crafted upload filename lets attackers run OS commandsOther2026-11-03 17:18 UTCby NVD–WHAT TO DO CRITICAL9.9SolarWinds Dameware: command injection lets an authenticated user compromise remote hostsDamewareOther2026-11-03 17:18 UTCby InfraStack Analyst–FIX 2026.3.1 HIGH8.4SolarWinds Dameware: buffer overflow lets an authenticated user run codeDamewareInfrastructure2026-11-03 17:18 UTCby InfraStack Analyst–FIX 2026.3.1 HIGH8.2SolarWinds Dameware: DLL hijacking during installation lets an admin-level local user gain code executionDamewareOther2026-11-03 17:18 UTCby InfraStack Analyst–FIX 2026.3.1 MEDIUM4.2Lightdash: authorization bypass lets users alter dashboards in other projectsAI agents & MCP2026-11-03 16:35 UTCby NVD–WHAT TO DO MEDIUM4.8wlroots: out-of-bounds read leaks compositor heap memory via X11 window classRuntime2026-11-03 17:18 UTCby NVD–WHAT TO DO HIGH8.5Solanum IRC server: overlong kill reason overflows buffer, risks code executionRuntime2026-11-03 17:18 UTCby NVD–WHAT TO DO HIGH8.5Solanum IRC server: linked-server overlong channel names overflow heap memoryPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM6.1TeXlyre: stored XSS via malicious LSP or typesetter recipe iconsPackage2026-10-28 20:44 UTCby NVD–WHAT TO DO MEDIUM6.9Coolify: unauthenticated webhooks leak application names across all teamsRuntime2026-11-03 17:18 UTCby NVD–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDGitBook breached: attackers got into parts of GitBook's infrastructure on 2 Nov; docs sites and editor taken offline, customer data impact unknownGitBookVendor2026-11-02 17:00 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5phpMyAdmin SQL-Parser: type conversion flaw in EXPLAIN statement parsingPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.0phpMyAdmin ShapeFile: crafted SHP file makes the handler loop foreverPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM6.5GStreamer: crafted JPEG 2000 media can crash apps processing itPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3Uncanny Automator WordPress plugin: missing authorization check through version 7.7.1Package2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM6.5WordPress Posts Table plugin: stored XSS through versions up to 1.4.14Package2026-11-03 17:18 UTCby NVD–WHAT TO DO HIGH8.6MongoDB Database Tools: mongorestore can create unauthorized root database accountsPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO LOW3.7MongoDB Database Tools: mongorestore can write documents into the wrong collectionPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO LOW2.8MongoDB mongofiles: symlinks let downloads write files outside the working directoryPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.9MongoDB Database Tools: mongofiles can leak GridFS files to stdoutPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM6.5Paid Member Subscriptions WordPress plugin: stored XSS through version 3.1.3Package2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3ClickCease Click Fraud Protection WordPress plugin: missing authorization checkPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3Better Search WordPress plugin: missing authorization check exposes access controlPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3Dokan Lite WordPress plugin: missing authorization check exposes access controlsPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3Dokan Lite WordPress plugin: missing authorization check exposes access controlsPackage2026-11-03 17:18 UTCby NVD–WHAT TO DO MEDIUM5.3WordPress Forminator plugin: missing authorization check exposes form dataPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3WordPress Forminator plugin: stored XSS via unescaped HTML tagsPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5Elastic APM Server: oversized OTLP payloads can exhaust memory and stop intakeInfrastructure2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5Elasticsearch: crafted phonetic input exhausts heap memory, crashing the nodePackage2026-11-03 17:17 UTCby NVD–WHAT TO DO HIGH7.4Elastic Stack Docker images trust certificates from compromised eMudhra intermediate authoritiesElastic Docker images (APM Server, Beats, Elastic Agent, Logstash, connectors, Universal Profiling, Maps Server)Infrastructure2026-11-03 17:17 UTCby InfraStack Analyst–FIX 8.19.24 MEDIUM4.2Elasticsearch: shared query cache leaks hidden field matches between usersPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3Elasticsearch: field-level security gap lets users read a restricted fieldInfrastructure2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5Packetbeat: crafted AMQP traffic crashes the monitoring agent processInfrastructure2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3Kibana: connector logs leak across spaces to users with read accessInfrastructure2026-11-03 17:17 UTCby NVD–WHAT TO DO HIGH7.3Kibana Fleet: path traversal lets low-privilege user trigger unintended deletionsRuntime2026-11-03 17:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Kibana: Observability onboarding leaks Elasticsearch service credentials to authenticated usersPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM4.3Kibana: Machine Learning job messages leak across spaces to unauthorized usersRuntime2026-11-03 17:17 UTCby NVD–WHAT TO DO HIGH7.5Elasticsearch: unauthenticated crafted request to the remote cluster server interface crashes the nodeelasticsearchRuntime2026-11-03 17:17 UTCby InfraStack Analyst–FIX 8.19.24 MEDIUM4.3Elastic APM Server: crafted agent config request leaks another service's settingsInfrastructure2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM5.3WordPress AnyWhere Elementor plugin: missing authorization check through version 1.3.0Other2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5WordPress AnyWhere Elementor plugin: stored XSS through version 1.3.0Other2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.5WordPress AnyWhere Elementor plugin leaks embedded sensitive data in responsesPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUM6.8SonicWall GMS: authenticated SQL injection lets users read or change databaseVendor2026-11-03 17:17 UTCby NVD–WHAT TO DO CRITICAL9.1SonicWall GMS: unauthenticated network attacker can read internal filesSonicWall GMSInfrastructure2026-11-03 17:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4Docker Sandboxes sbx cp lets a sandbox escape its shared workspaceDocker Sandboxes (sbx)Other2026-11-03 17:17 UTCby InfraStack Analyst–FIX 0.51.0 MEDIUM4.3myCred WordPress plugin: missing authorization lets users bypass access controlsPackage2026-11-03 17:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDNetfoil doesn't decrement TTLgithub.com/tinfoil-factory/netfoilPackage2026-11-03 16:48 UTCby GitHub Advisories–FIX 0.6.1 LOWNOT SCOREDArc has unauthenticated application log disclosure via `/api/v1/logs`github.com/basekick-labs/arcAI agents & MCP2026-11-03 16:29 UTCby GitHub Advisories–FIX 0.0.0-20260615165136-bb7d9761ad98 MEDIUM6.9Securepoint SSL VPN Client on Windows: local users gain SYSTEM privilegesOther2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.6Volmarg Personal Management System: file upload lets logged-in users run PHP codepersonal-management-systemPackage2026-11-03 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.0Slurm: slurmstepd mishandles invalid step socket requests (heap overflow per NVIDIA CVE); fixed in 25.05.9, 25.11.8, 26.05.4slurmInfrastructure2026-10-28 15:19 UTCby InfraStack Analyst–FIX 25.05.9 MEDIUM5.3NVIDIA Slurm: user can reach compute nodes outside their job allocationInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM5.7NVIDIA Slurm: Operator accounts can escalate themselves to AdministratorInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM6.3NVIDIA Slurm: SQL injection via SlurmDBD RPCs allows arbitrary code executionInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM6.3NVIDIA Slurm: slurmstepd socket API lets attacker read arbitrary memoryInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM4.7NVIDIA Slurm: symlink flaw lets attacker delete files on compute nodesInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM6.3NVIDIA Slurm: heap buffer overflow in slurmstepd lets attackers run as rootInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO MEDIUM6.3NVIDIA Slurm: user can alter group list to write files they cannot accessInfrastructure2026-10-28 15:19 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDTactical RMM: stored XSS in tools database runs script in viewers' browsersRuntime2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW1.8whatstk: merge_chats() silently drops messages from merged WhatsApp chat exportsPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9CTFd: unauthenticated teams API leaks hidden registration fields like emailsOther2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH7.7Label Studio: image export lets logged-in users reach internal URLs and steal tokensAI agents & MCP2026-09-29 14:48 UTCby NVD–WHAT TO DO HIGH7.1LogChimp: authors can overwrite other users' posts via mismatched IDsPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.6GLPI: technician accounts can clone a Super-Admin accountPackage2026-11-02 13:19 UTCby NVD–WHAT TO DO MEDIUM4.3AuditPilot: authorization bypass lets users read other projects' knowledgePackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.2WPPConnect Server: missing auth lets anyone send WhatsApp messageswppconnect-serverAI agents & MCP2026-11-03 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7FastBee: IDOR in ProductController lets tenants read and edit other tenants' productsOther2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.7Foxel: missing authentication lets anonymous users read any stored fileOther2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.2cordova-plugin-advanced-http: redirects leak session cookies to third-party hostsPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.3Cotonti: predictable email tokens let attackers take over unverified accountsRuntime2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Dromara domain-admin: authenticated users can read other groups' member listsOther2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4PostfixAdmin: stored XSS in TOTP exception description runs in admin sessionPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW3.3nnn: predictable FIFO path lets local users redirect file writesPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM4.4nnn: pdfread and nuke plugins let local users overwrite files via /tmp symlinksPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.4nnn file manager: crafted filenames run commands in togglex pluginPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW2.2dysk: unsanitized mount metadata lets local users spoof terminal outputPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.0ruTorrent: datadir plugin path traversal lets users escape their directory jailPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Dreeve: forged Strava webhook events can delete imported activitiesPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Koodo Reader: OPDS cover handler lets authenticated users read server filesPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.8smart-sso: any logged-in user can grant themselves administrator rolePackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4DbGate: connection-restricted users can probe hosts and overwrite saved connectionsPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.3Padloc: SCIM endpoint leaks user and group directory to unauthenticated callersOther2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM5.1SQLBot: path traversal in importToDb lets admins read server filesAI agents & MCP2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.3bbs-go: SMTP certificate checks disabled, letting network attackers steal mail credentialsRuntime2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.8AB Download Manager: web pages can write files to any pathPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH7.7CFNext: subscription UUID leaks admin password through weak MD5 derivationPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH9.1Ziroom ZHOME A0101 router firmware: remote code injection via Lua handlerZHOME A0101Infrastructure2026-11-03 16:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.4HDF5: crafted file triggers NULL pointer crash when openedPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9HDF5: crafted external link causes heap over-read when traversedPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW1.9HDF5: crafted file over-reads heap memory when openedPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM4.7HDF5: crafted szip chunk causes out-of-bounds read and crashPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW1.9HDF5: scale-offset decoder returns uninitialized heap memory from crafted filesPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH8.7rsync: crafted checksums let a client exhaust sender CPUPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO HIGH7.6ash_authentication: TOTP setup flaw lets users take over other accounts' second factorPackage2026-11-03 15:31 UTCby NVD–WHAT TO DO MEDIUM6.3ash_authentication: brute-force protection silently not applied to sign-inPackage2026-11-03 15:31 UTCby NVD–WHAT TO DO HIGH7.5Eclipse Vert.x STOMP: unbounded frame buffering lets a peer exhaust memoryio.vertx:vertx-stompPackage2026-11-03 10:01 UTCby InfraStack Analyst–FIX 4.5.36 MEDIUM6.9Django GIS: crafted spatial reference strings can read local files or trigger requestsPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW2.2Django: admin read-only form exposes password hashes to view-only staffPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO LOW3.1Django: cache keys collide, letting one request read another's cached private dataPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Django: GeoJSON input can trigger server-side requests to attacker-chosen destinationsRuntime2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Django: GIS geometry form field lets attackers forge log entriesPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9Django: multipart uploads with base64 encoding can exhaust server memoryPackage2026-11-03 16:17 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: MMS Delivery Receipt Delays from a Subset of Twilio Long Codes and Short Codes to AT&T United StatesTwilioVendor2026-11-03 15:43 UTCby status page–WHAT TO DO HIGHINCIDENTSentry: Delays in spans and transactions processingSentryVendor2026-11-03 15:40 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Increased Durable Object Errors in the Dallas, TX US regionCloudflareVendor2026-11-03 15:38 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @vanzxy/nusa (npm)@vanzxy/nusaPackage2026-11-03 15:23 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @vanzxy/baileys (npm)@vanzxy/baileysPackage2026-11-03 15:23 UTCby osv-malicious–UNINSTALL MEDIUM6.9Linux GPU driver: NULL pointer dereference can crash the kernelInfrastructure2026-11-03 15:17 UTCby NVD–WHAT TO DO MEDIUM5.2AMD Compressonator SDK: crafted DDS file can corrupt heap or crashPackage2026-11-03 15:17 UTCby NVD–WHAT TO DO MEDIUM5.2AMD Compressonator SDK: heap over-read lets a local user leak memoryPackage2026-11-03 15:17 UTCby NVD–WHAT TO DO MEDIUM5.1AMD Compressonator SDK: crafted DDS file causes integer overflow and denial of servicePackage2026-11-03 15:17 UTCby NVD–WHAT TO DO MEDIUM5.2AMD Compressonator SDK: crafted TGA file leaks heap memory or crashesPackage2026-11-03 15:17 UTCby NVD–WHAT TO DO HIGH7.5µD3TN SPP parser heap overflow lets remote attackers crash the serviceud3tnOther2026-11-03 15:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5µD3TN: BPv6 bundles with many EID references leak memory, letting an unauthenticated peer crash the node (fixed in 0.15.2)ud3tnOther2026-11-03 15:17 UTCby InfraStack Analyst–FIX 0.15.2 HIGH7.1µD3TN: integer wrap in fragmenter bounds check lets an external dispatcher read heap memory or crash the daemonud3tnPackage2026-11-03 15:17 UTCby InfraStack Analyst–FIX 0.15.2 HIGH7.5µD3TN BPv6 admin record parser: remote heap write causes denial of serviceud3tnOther2026-11-03 15:17 UTCby InfraStack Analyst–FIX 0.15.2 MEDIUM5.9µD3TN: use-after-free in BPv6 fragmenter lets remote attackers crash the serviceInfrastructure2026-11-03 15:17 UTCby NVD–WHAT TO DO MEDIUM5.9µD3TN BPv6 fragmenter: double free lets a remote attacker crash the serviceRuntime2026-11-03 15:17 UTCby NVD–WHAT TO DO HIGH7.4NTPsec: crafted NTP replies corrupt memory and can bypass NTS time authenticationRuntime2026-11-03 15:17 UTCby NVD–WHAT TO DO LOW3.7NTPsec: NTS client over-reads memory and leaks pointers to serversPackage2026-11-03 15:17 UTCby NVD–WHAT TO DO HIGH7.1Dockhand: deploy responses leak plaintext stack secrets to authorized usersOther2026-10-19 08:38 UTCby NVD–WHAT TO DO HIGH8.7Dockhand: path traversal lets logged-in users read and overwrite secret filesPackage2026-10-19 08:37 UTCby NVD–WHAT TO DO MEDIUM6.1svg-sanitizer: javascript URLs in animateTransform bypass sanitization, enabling XSSPackage2026-10-19 12:09 UTCby NVD–WHAT TO DO MEDIUM5.3svg-sanitizer: CSS escapes let SVG files fetch remote URLsPackage2026-10-19 12:09 UTCby NVD–WHAT TO DO HIGH8.2svg-sanitizer: regex flaw lets crafted SVGs exhaust CPU or bypass sanitizingPackage2026-10-19 12:09 UTCby NVD–WHAT TO DO HIGH8.7svg-sanitizer: crafted SVG pins PHP workers for hoursPackage2026-10-19 12:09 UTCby NVD–WHAT TO DO MEDIUM6.9svg-sanitizer: truncated SVG input crashes requests with an uncaught errorPackage2026-10-20 09:46 UTCby NVD–WHAT TO DO MEDIUM5.3Frappe HRMS: employees can view other employees' expense advance recordsPackage2026-10-19 07:02 UTCby NVD–WHAT TO DO MEDIUM6.3Wasmtime: wasi-http lets guests send conflicting content-length headersRuntime2026-10-19 19:20 UTCby NVD–WHAT TO DO MEDIUM6.3Wasmtime: forwarded trailers bypass embedder header filtering in WASIp3Runtime2026-10-19 19:20 UTCby NVD–WHAT TO DO MEDIUM6.9Wasmtime: guests can forge content-length headers, enabling HTTP response splittingRuntime2026-10-19 19:20 UTCby NVD–WHAT TO DO MEDIUM6.9Mistune: crafted Markdown with nested brackets exhausts CPUPackage2026-10-19 11:05 UTCby NVD–WHAT TO DO HIGH8.7Mistune: quadratic emphasis parsing lets small markdown stall workersPackage2026-10-19 11:05 UTCby NVD–WHAT TO DO HIGH8.6Froxlor: admins with customers_see_all can read every account's API keyRuntime2026-10-20 07:24 UTCby NVD–WHAT TO DO MEDIUM5.3Froxlor: customers can create MySQL databases despite admin banRuntime2026-10-20 07:24 UTCby NVD–WHAT TO DO MEDIUM5.4Froxlor: customers with API access can replace managed HTTPS certificatesOther2026-10-20 07:23 UTCby NVD–WHAT TO DO MEDIUM5.4AzuraCast: stored CSV formula injection via bulk media importOther2026-10-18 18:34 UTCby NVD–WHAT TO DO MEDIUM5.1AzuraCast: CRLF injection lets station users rewrite public playlist streamsRuntime2026-10-18 15:30 UTCby NVD–WHAT TO DO MEDIUM6.9AzuraCast: station users can reach internal services through webhook connectorsPackage2026-10-18 15:58 UTCby NVD–WHAT TO DO MEDIUM5.4AzuraCast: missing permission check lets users read and overwrite other stations' waveformsRuntime2026-10-18 16:23 UTCby NVD–WHAT TO DO HIGH8.8AzuraCast: station users can run OS commands through StereoTool settingsazuracast/azuracastAI agents & MCP2026-10-18 15:44 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8AzuraCast: timezone field lets station managers run commands as rootOther2026-10-18 16:50 UTCby NVD–WHAT TO DO HIGH8.7AzuraCast: station profile users can hijack Shoutcast frontend configPackage2026-10-18 17:16 UTCby NVD–WHAT TO DO HIGH8.3Nodemailer: address parser lets mail reach attacker-chosen domains, bypassing allow listsPackage2026-10-19 12:06 UTCby NVD–WHAT TO DO HIGH8.3Nodemailer: address parser flaw lets crafted emails bypass recipient allow listsPackage2026-10-19 12:05 UTCby NVD–WHAT TO DO HIGH8.3Nodemailer: address parser lets attackers redirect email to hidden recipientsPackage2026-10-19 12:05 UTCby NVD–WHAT TO DO HIGH7.1SurrealDB: nested values crash the database server for all tenantsAI agents & MCP2026-10-19 08:51 UTCby NVD–WHAT TO DO MEDIUM5.1SurrealDB: JWKS URLs bypass deny-net rules, enabling internal server-side requestsAI agents & MCP2026-10-19 08:51 UTCby NVD–WHAT TO DO MEDIUM5.3SurrealDB: port-specific network deny rules can be bypassed, enabling internal SSRFAI agents & MCP2026-10-19 08:51 UTCby NVD–WHAT TO DO MEDIUM4.8SurrealDB: SSRF via IPv6 transition addresses reaches internal hostsAI agents & MCP2026-10-19 08:51 UTCby NVD–WHAT TO DO HIGH8.6SurrealDB: MCP session fingerprint lets one user hijack another's sessionAI agents & MCP2026-10-19 08:51 UTCby NVD–WHAT TO DO MEDIUM5.3SurrealDB: record users can infer restricted field values via indexesOther2026-10-19 08:52 UTCby NVD–WHAT TO DO HIGH8.8SurrealDB: use-after-free in storage backends can crash or corrupt memoryPackage2026-10-19 08:52 UTCby NVD–WHAT TO DO HIGH7.1SurrealDB: method-style calls bypass denied functions for authenticated usersPackage2026-10-19 08:52 UTCby NVD–WHAT TO DO MEDIUM6.3Parse Server: null dot-notation keys bypass field type checks on MongoDBPackage2026-10-19 19:34 UTCby NVD–WHAT TO DO HIGH8.2Parse Server: crafted object update crashes the Node processPackage2026-10-19 00:45 UTCby NVD–WHAT TO DO LOW3.1Parse Server: session upgrade endpoint mints new sessions without permission checkPackage2026-10-20 00:36 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: proxy memory grows unbounded, letting clients degrade servicePackage2026-10-19 12:07 UTCby NVD–WHAT TO DO LOW3.1FreeRDP: malicious RDP server can crash X11 client via oversized surface outputPackage2026-10-19 07:29 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malicious RDP server crashes client session via zero-size surfacePackage2026-10-19 07:38 UTCby NVD–WHAT TO DO HIGH8.2FreeRDP: oversized routing token crashes RDP clients and proxiesRuntime2026-10-19 12:31 UTCby NVD–WHAT TO DO MEDIUM6.0FreeRDP: USB redirection flaw lets a malicious server crash the clientRuntime2026-10-19 12:08 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: crafted remdesk payload crashes the shadow server, dropping sessionsRuntime2026-10-19 12:06 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malicious RDP server can crash client with zero-output payloadRuntime2026-10-19 12:05 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: unbounded serial IRP buffer lets a malicious server exhaust client memoryPackage2026-10-19 12:05 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: authenticated clients can exhaust server CPU via empty RDP messagesRuntime2026-10-19 12:33 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malformed drive request lets a rogue server exhaust client memoryPackage2026-10-19 07:39 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server crashes xfreerdp client via ResetGraphicsPackage2026-10-19 12:09 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malicious RD Gateway packet crashes the client with a null dereferencePackage2026-10-19 12:29 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: malicious RD Gateway can pin client CPU with stalled packetOther2026-10-19 12:11 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malicious RD Gateway forces 2 GiB allocation, crashing clientsPackage2026-10-19 12:11 UTCby NVD–WHAT TO DO HIGH8.2FreeRDP proxy: use-after-free during teardown lets a malicious target crash itRuntime2026-10-19 12:10 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malicious RDP server can leak client memory through clipboard imagesRuntime2026-10-19 12:10 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP client: malformed RD Gateway packet aborts the connecting client processPackage2026-10-19 12:35 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server can crash client via RemoteFX tilePackage2026-10-19 12:04 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server crashes clients via RemoteFX decoder assertionRuntime2026-10-19 12:04 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: crafted RemoteFX rectangles crash RDP clients built with verbose assertionsPackage2026-10-19 12:04 UTCby NVD–WHAT TO DO CRITICAL9.1FreeRDP: certificate check accepts wrong server names, enabling interception of RDP sessionsPackage2026-10-19 12:13 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: repeated create requests leak file descriptors and crash the clientPackage2026-10-19 12:11 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: malformed gateway response crashes the client via reachable assertionPackage2026-10-19 12:03 UTCby NVD–WHAT TO DO LOW3.1FreeRDP: malformed device-list packet from a server aborts the clientPackage2026-10-19 07:28 UTCby NVD–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server can exhaust client memory via dynamic channelPackage2026-10-19 12:36 UTCby NVD–WHAT TO DO MEDIUM5.3FreeRDP: truncated GSM610 audio frame lets a malicious server crash the clientPackage2026-10-19 12:04 UTCby NVD–WHAT TO DO HIGH8.7FreeRDP: malformed PNG or JPEG clipboard data crashes the clientPackage2026-10-19 12:12 UTCby NVD–WHAT TO DO HIGH7.5Eclipse Vert.x: shared web client cache leaks one user's responses to othersvertx-web-clientPackage2026-11-03 10:01 UTCby InfraStack Analyst–FIX 4.5.36 MEDIUM5.9Eclipse Vert.x: unbounded buffering from malicious server can exhaust memoryPackage2026-11-03 10:01 UTCby NVD–WHAT TO DO MEDIUM6.5runZero: malformed search query returns results from other organizationsVendor2026-11-03 15:17 UTCby NVD–WHAT TO DO HIGH7.1HUSTOJ: any registered user can delete or lock forum threadshustojOther2026-11-03 15:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9AMD Compressonator SDK: crafted DDS file can crash process or leak heap memoryPackage2026-11-03 15:17 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @lynnidoffc/libsignal-node (npm)@lynnidoffc/libsignal-nodePackage2026-11-03 15:17 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @lynnidoffc/baileys (npm)@lynnidoffc/baileysPackage2026-11-03 15:17 UTCby osv-malicious–UNINSTALL CRITICALINCIDENTSentry: Sentry.io dashboard and API is downSentryVendor2026-11-03 14:57 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: MMS Delivery Delays and Failures from a Subset of Twilio Long Codes and Short Codes to Multiple Networks in United StatesTwilioVendor2026-11-03 14:51 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Cloudflare Workers and Pages build errorsCloudflareVendor2026-11-03 14:46 UTCby status page–WHAT TO DO HIGHCAMPAIGNEXPLOITED3AMThreeAM3AM ransomware affiliate uses an AI agent loop to steal Veeam backup credentials, add rogue domain admins and link separate AD domains before encrypting (Bitdefender)Veeam Backup & ReplicationOther2026-11-03by InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDEclipse Mnestix AAS Generator: unbounded count lets remote callers exhaust memoryPackage2026-11-03 14:17 UTCby NVD–WHAT TO DO HIGH8.8Zephyr: CAN filter keeps freed message queue pointer, enabling kernel heap corruptionRuntime2026-11-02 22:19 UTCby NVD–WHAT TO DO MEDIUM6.7Zephyr Bluetooth: oversized GATT notifications overflow LE Audio client bufferRuntime2026-11-02 22:18 UTCby NVD–WHAT TO DO MEDIUM4.6Zephyr Bluetooth AVRCP: link drop mid-response stalls later responses and leaks buffersRuntime2026-11-02 21:42 UTCby NVD–WHAT TO DO MEDIUM4.8Zephyr MCTP USB: race between RX worker and disable frees live bufferRuntime2026-11-02 21:30 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDFirefox: layout engine boundary bug in Block and Inline componentRuntime2026-11-03 14:17 UTCby NVD–WHAT TO DO HIGH8.6Nagios XI: admin MIB upload lets a crafted filename run OS commandsInfrastructure2026-11-03 14:17 UTCby NVD–WHAT TO DO HIGH8.3MongoDB Node.js driver: pooled connections can mix up replies between requestsmongodbPackage2026-11-03 14:17 UTCby InfraStack Analyst–FIX 6.22.0 MEDIUMINCIDENTCircleCI: Increased wait time for Machine jobsCircleCIVendor2026-11-03 14:14 UTCby status page–WHAT TO DO MEDIUMINCIDENTGitHub: Incident with API, Git, and Copilot requestsGitHubVendor2026-11-03 13:25 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: TCP connection timer race lets memory be reused after freeRuntime2026-11-03 13:17 UTCby NVD–WHAT TO DO HIGH8.8BuddyBoss App WordPress plugin: arbitrary file upload enables remote code executionbuddyboss-appPackage2026-11-03 13:17 UTCby InfraStack Analyst–FIX 3.2.2 MEDIUM5.5NVIDIA nvJPEG: crafted input can trigger divide-by-zero and crashRuntime2026-11-03 13:17 UTCby NVD–WHAT TO DO HIGH7.1Instatic: AI/MCP read tools expose other users' private draftsAI agents & MCP2026-11-03 10:04 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery note recordsOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored XSS in delivery note fields runs script in other users' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery note fields runs in other users' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery note fields runs in victims' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery notes runs in viewers' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery notes runs in other users' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored XSS in delivery note records runs scripts for other usersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery notes runs in victims' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored XSS in delivery note records runs script in other users' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery note fields runs in victims' browsersOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite: stored script injection in delivery note recordsOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM5.1Alosuite login page can be framed for clickjacking attacksOther2026-11-03 13:17 UTCby NVD–WHAT TO DO MEDIUM6.9Alosuite: password recovery endpoint has no request limit, enabling email floodsOther2026-11-03 13:17 UTCby NVD–WHAT TO DO HIGH8.6Alosuite: user invitation flaw lets attacker grant administrator rightsALO SuiteOther2026-11-03 13:17 UTCby InfraStack Analyst–FIX 26_04_15.03_10 MEDIUM6.9Alosuite: unauthenticated IDOR exposes other companies' and users' dataOther2026-11-03 13:17 UTCby NVD–WHAT TO DO HIGHCAMPAIGNDATA EXPOSEDLLMjackingUNC6993LLMjacking crews (UNC6993, Jet Night) use stolen cloud keys and tokens to run up AWS Bedrock, Gemini and Azure OpenAI bills of $100K+/day and resell the access (Google GTIG)AWS Bedrock3 talkingInfrastructure2026-10-30by InfraStack Analyst3talkingWHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nulio-connector (npm)nulio-connectorPackage2026-11-03 12:27 UTCby osv-malicious–UNINSTALL NOT SCOREDNOT SCOREDLinux kernel: sched_ext race can corrupt task scheduling stateRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring ring pollers can sleep through pending completionsRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring NAPI entries never expire, keep being polledRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring zero-copy receive returns wrong buffers above 4GBRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel io_uring: pipe error path can remove unrelated fixed filesInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring receive retries can hand out the same buffer twiceRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel io_uring: poll retry wakeups can be lost, stalling requestsRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDLinux kernel: io_uring timeout cancel can be lost, stalling exiting tasksRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: AMD GPU driver fence slot error during buffer evictionRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: NTFS resident attribute conversion flaw skips needed conversionInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: uninitialised clock rate on 32-bit Tegra suspend pathRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel Hyper-V: VP index lookup writes to unallocated memory in SEV-SNP guestsInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: shared GPIO lookup without a device causes a NULL dereferenceRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: dm cache lock misuse triggers kernel warning on suspend and resumeRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring race can hang a task that is exitingRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel io_uring: exiting task flooded with task_work, stalling CPUsRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring race can leave a task stuck during exec or exitRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring queue push race can stall a high-priority consumerRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Hyper-V driver can loop forever during CPU setupRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: console printing threads start too early, can hang SMP bootInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: suspend can hang while a pid namespace init waitsInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDLinux kernel I2C xiic driver: clock warning flood on teardownRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDLinux kernel: tracing init can dereference a NULL pointer at bootInfrastructure2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel TIPC: use-after-free in node reset trace dumpRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: keyring restriction race lets rejected keys linkRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: PID namespace reaper can busy-wait instead of sleepingRuntime2026-11-03 12:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: io_uring worker exit can hang on weakly ordered CPUsOther2026-11-03 12:17 UTCby NVD–WHAT TO DO CRITICALCAMPAIGNEXPLOITEDAttackers exploit unauthenticated Node-RED editors (CVE-2026-58115, Siemens SIMATIC IoT2050) to deploy a Linux bot and command webshells (VulnCheck)Node-RED1 talkingInfrastructure2026-11-02by InfraStack Analyst1talkingFIX V4.3.4.1 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in blitzstrike (npm)blitzstrikePackage2026-11-03 11:25 UTCby osv-malicious–UNINSTALL MEDIUMNOT SCOREDApache HertzBeat: incomplete XPath validation lets authenticated users exhaust collector CPUPackage2026-11-03 11:16 UTCby NVD–WHAT TO DO HIGH8.8Eclipse Mnestix Browser: unauthenticated users can perform privileged actionsPackage2026-11-03 10:17 UTCby EPSS–WHAT TO DO CRITICAL9.2Eclipse Mnestix Browser: unauthenticated attacker can steal backend API keysPackage2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUM5.1BlueLM Copilot: path traversal lets a rogue Android app write filesOther2026-11-03 10:17 UTCby EPSS–WHAT TO DO HIGH7.1ManageEngine Key Manager Plus: logged-in users can export other users' certificatesVendor2026-11-03 10:17 UTCby EPSS–WHAT TO DO HIGH7.1ManageEngine Key Manager Plus: access control flaw lets users change others' ACME credentialsInfrastructure2026-11-03 10:17 UTCby EPSS–WHAT TO DO HIGH8.1ManageEngine Key Manager Plus: input when configuring Microsoft CA lets users attackVendor2026-11-03 10:17 UTCby EPSS–WHAT TO DO HIGH8.8Joomla extension: email confirmation links delete accounts without valid hashOther2026-11-03 10:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.1TYPO3 mail module: unescaped HTML lets backend users run scriptsOther2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Mail module fetches external URLs without host checks, enabling internal requestsOther2026-11-03 10:17 UTCby EPSS–WHAT TO DO HIGH7.1TYPO3 mail module lets backend users reach mails outside their page accessPackage2026-11-03 10:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3TYPO3 mail module lets backend users write arbitrary page TSconfigRuntime2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Click tracking middleware skips recipient code check, exposing newsletter recipient dataPackage2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Click tracking middleware redirects users to arbitrary external URLsOther2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUM6.5GStreamer gst-plugins-good: malformed FLV file crashes media-playing applicationsPackage2026-11-03 10:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDApache JClouds: unrestricted XML entity expansion in DTD parsingPackage2026-11-03 10:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache Oozie: authenticated users can take over other tenants' workflow jobsInfrastructure2026-11-03 10:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dsh-moss-wallpaper (npm)dsh-moss-wallpaperPackage2026-11-03 10:01 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vibes-plug (npm)vibes-plugPackage2026-11-03 09:21 UTCby osv-malicious–UNINSTALL MEDIUMNOT SCOREDesmf-sdk Python loader: crafted Turtle file reads Turtle files outside models folderPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Eupago Gateway WooCommerce plugin: forged webhooks can mark unpaid orders paidPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.4AxxonNet: shared read-only report token can change monitoring alertsOther2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.8AxxonNet ARP Agent: LDAP service account password written to logsInfrastructure2026-11-03 09:17 UTCby EPSS–WHAT TO DO CRITICAL9.2AxxonSoft Axxon One: default admin password lets remote attackers log inVendor2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.8AxxonSoft Axxon One: LDAP service account password stored in plaintext configVendor2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3AxxonSoft Axxon One: low-privilege users can list all accounts and rolesInfrastructure2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.9pybddisasm: uninitialized output buffer can leak process memory on failurePackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM4.8pybddisasm: uninitialized memory after failed decode may leak process memoryPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.9pybddisasm: use-after-free in INSTRUX array elements can leak process memoryPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.9pybddisasm: freed memory reused after INSTRUX object is releasedPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO MEDIUM4.8pybddisasm: out-of-bounds read can leak adjacent process memoryPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO HIGH8.5Eclipse ThreadX: user-mode module can run code with privileged accessthreadxRuntime2026-11-01 17:32 UTCby InfraStack Analyst–FIX 6.5.2.202603b HIGH7.3Eclipse ThreadX: unloaded module callback can run with kernel privilegesRuntime2026-11-01 17:32 UTCby EPSS–WHAT TO DO MEDIUM6.9Digital I/O function bounds check flaw allows remote denial of serviceInfrastructure2026-11-03 09:17 UTCby EPSS–WHAT TO DO HIGH8.6IPsec VPN input validation flaw lets privileged remote attacker run root commandsInfrastructure2026-11-03 09:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Welotec TK100, TK500-v2 and TK500-v3 routers: Digital I/O command injection gives root to an adminTK100Infrastructure2026-11-03 09:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6WireGuard VPN function lets a privileged remote attacker run root commandsInfrastructure2026-11-03 09:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6ZeroTier VPN: input validation flaw lets a privileged remote attacker run root commandsInfrastructure2026-11-03 09:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Management control functions let a privileged remote user run root commandsInfrastructure2026-11-03 09:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3CryptoCloud WordPress plugin: forged payment callbacks mark orders paidPackage2026-11-03 09:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCatalyst Perl authentication plugin: password checks leak timing, enabling guessesPackage2026-11-03 08:17 UTCby EPSS–WHAT TO DO CRITICAL9.8WSO2 API Manager: self-registered users can reach admin System REST APIs when Identity Server is Resident Key ManagerWSO2 API ManagerInfrastructure2026-11-03 08:17 UTCby InfraStack Analyst–FIX latest U2 update level + updated IS connector HIGH7.5ManageEngine Log360 and EventLog Analyzer: collector registration bypasses authenticationEventLog AnalyzerVendor2026-11-03 08:17 UTCby InfraStack Analyst–FIX 13071 CRITICAL9.1ManageEngine Log360 and EventLog Analyzer builds 13025 to 13061: improper access control allows unauthorized access (fixed in 13062)EventLog AnalyzerInfrastructure2026-11-03 08:17 UTCby InfraStack Analyst–FIX 13062 MEDIUMNOT SCOREDbillboard.js: unsanitized series ids let attackers run JavaScript in the pagePackage2026-10-16 03:05 UTCby EPSS–WHAT TO DO MEDIUM6.7Qt CoAP: malformed message parsing reads out of bounds, crashing appsPackage2026-11-03 08:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dsh-moss-console (npm)dsh-moss-consolePackage2026-11-03 07:25 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCloudflare: Elevated number of 5xx errors in HKGCloudflareVendor2026-11-03 07:24 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDWhale Browser: iframe sandbox can be bypassed in dual-tab setupsOther2026-11-03 07:18 UTCby EPSS–WHAT TO DO MEDIUM6.1Unknown product's login page reflects input, enabling browser script injectionOther2026-11-03 07:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Identity provider: disabled IDP still issues access tokens via JWT or SAML bearerVendor2026-11-03 07:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in luna-baileys (npm)luna-baileysPackage2026-11-03 06:46 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in service-roles-registry (npm)service-roles-registryPackage2026-11-03 06:29 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in paidwithtab (npm)paidwithtabPackage2026-11-03 06:27 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDAZEXO Store Locator WordPress plugin lets any logged-in user delete postsazexo-store-locatorPackage2026-11-03 06:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDDT LMS WordPress plugin: unauthenticated users can revoke learners' course completionsPackage2026-11-03 06:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDDT Directory Lite Addon WordPress plugin lets anyone change its settingsPackage2026-11-03 06:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWordPress Gallery for Social Photo plugin: unauthenticated server-side request forgeryfeed-instagram-litePackage2026-11-03 06:17 UTCby InfraStack Analyst–FIX 1.0.0.43 MEDIUMNOT SCOREDWordPress weMail plugin: Editors can read site-wide email API keyPackage2026-11-03 06:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDweMail WordPress plugin: editors gain admin actions through REST API checksPackage2026-11-03 06:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDWATI Chat WordPress plugin leaks WooCommerce customer names, addresses and emailswati-chat-and-notificationPackage2026-11-03 06:17 UTCby InfraStack Analyst–WHAT TO DO

Tuesday, Nov 3Last 24 hoursUp to now