🔍 Intelligence Synthesis JP/EN
Ethics · Regulation · Technology — Pharma Practice Notes

Security Watch

Every 30 minutes we collect from government CERTs, the CISA Known Exploited Vulnerabilities catalog, NIST NVD, vendor PSIRTs and the GitHub Advisory Database (every major language ecosystem), and rank by severity.

6Exploited, 7 days
25CVSS ≥ 9, 24 h
2335Advisories, 7 days

Last collected 2026-11-04 00:04 ・ Sources OK 19 / 20 (failed: JVN iPedia）

Exploited or CVSS ≥ 9 (7 days)

DateItemSource
2026-11-03CVSS 9.2CVE-2026-89292: In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.NVD（米国 NIST）
2026-11-03CVSS 9.2CVE-2026-121022: Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentialsNVD（米国 NIST）
2026-11-03CVSS 9.8CVE-2026-4052: This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 ANVD（米国 NIST）
2026-11-03CVSS 9.1CVE-2026-13594: Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.NVD（米国 NIST）
2026-11-03CVSS 9.8CVE-2026-120534: The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation ofNVD（米国 NIST）
2026-11-03CVSS 9.1CVE-2026-120518: The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink()NVD（米国 NIST）
2026-11-03CVSS 9.8CVE-2026-86596: The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tagsNVD（米国 NIST）
2026-11-03CVSS 9.4CVE-2026-97718: CVE-2026-97718 Is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.NVD（米国 NIST）
2026-11-03CVSS 9.8CVE-2026-102435: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This maNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-116769: CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.NVD（米国 NIST）
2026-11-03CVSS 9.5CVE-2026-105606: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmpNVD（米国 NIST）
2026-11-03CVSS 9.4CVE-2026-105603: Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.NVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-105604: Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.NVD（米国 NIST）
2026-11-03CVSS 9.4CVE-2026-119085: Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with thNVD（米国 NIST）
2026-11-03CVSS 9.8CVE-2026-106803: A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled portNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-105769: kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismNVD（米国 NIST）
2026-11-03CVSS 9.1CVE-2026-88811: Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11NVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-77876: Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescapedNVD（米国 NIST）
2026-11-03CVSS 9.1CVE-2026-94290: SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubeconfig secrets a FleetNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-120442: ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign toNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-73695: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-73696: Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() whiNVD（米国 NIST）
2026-11-03CVSS 9.3CVE-2026-73697: Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled contenNVD（米国 NIST）
2026-11-03CVSS 9.2CVE-2026-120447: HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a usNVD（米国 NIST）
2026-11-03CVSS 9.1CVE-2026-120459: python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application'sNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-116606: An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup arNVD（米国 NIST）
2026-11-02CVSS 9.1CVE-2026-120213: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix optionNVD（米国 NIST）
2026-11-02CVSS 9.4CVE-2025-11969: The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operationNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120345: A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument dataNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120344: A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_nNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120279: A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead tNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120280: A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_NVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120281: A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based bufNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120283: A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow.NVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120276: A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument grNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-120277: A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the arguNVD（米国 NIST）
2026-11-02CVSS 10.0CVE-2026-120338: Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. FroNVD（米国 NIST）
2026-11-02CVSS 9.3CVE-2026-62048: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.NVD（米国 NIST）
2026-11-01CVSS 9.9CVE-2026-120307: The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, includinNVD（米国 NIST）
2026-11-01CVSS 9.9CVE-2026-120308: A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifier from the stub confNVD（米国 NIST）
2026-11-01CVSS 9.9CVE-2026-120306: Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah invocation passes --NVD（米国 NIST）
2026-11-01CVSS 9.3CVE-2026-120198: A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection.NVD（米国 NIST）
2026-11-01CVSS 9.3CVE-2026-120195: A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulatiNVD（米国 NIST）
2026-11-01CVSS 9.3CVE-2026-120189: A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipulation leads to stackNVD（米国 NIST）
2026-11-01CVSS 9.8CVE-2026-118636: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peerNVD（米国 NIST）
2026-11-01CVSS 9.3CVE-2026-120201: Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. AttackerNVD（米国 NIST）
2026-11-01CVSS 9.3CVE-2026-120209: AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint,NVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-118235: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload functioNVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-103882: The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id fNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-116512: The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.1 via the 'id' paramNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-119096: The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parserNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-109220: The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This isNVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-116557: The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpbs_action_ajax_calendar_remove_note() function in versions up toNVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-89270: The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.5 This is due to the plugin not properlNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-117656: Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter oNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-63377: TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, `POST /api/auth/setup` in `src/api/routers/auth.py` allows an unauthenticatedNVD（米国 NIST）
2026-10-31CVSS 9.8@signalk/resources-provider, signalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionGitHub Advisory（npm）
2026-10-31CVSS 9.8github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGitHub Advisory（go）
2026-10-31CVSS 9.8@signalk/resources-provider, signalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionGitHub Advisory（npm）
2026-10-31CVSS 9.8github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGitHub Advisory（go）
2026-10-31CVSS 9.9CVE-2026-62853: ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow.NVD（米国 NIST）
2026-10-31CVSS 9.6CVE-2026-62863: MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its `/sse` and `/message` HTTP endpoints do not authenticate requests and the `mcp-go` dependency sets `NVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-62849: ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData`NVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-117666: Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. tryNVD（米国 NIST）
2026-10-31CVSS 9.3pypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIGitHub Advisory（actions）
2026-10-31CVSS 9.3pypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIGitHub Advisory（actions）
2026-10-31CVSS 9.8CVE-2026-61620: HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQLNVD（米国 NIST）
2026-10-31CVSS 9.4CVE-2026-116241: pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslashNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-61850: Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the `project-scoped RBAC API` let an authenticated user with delegated permission toNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-78403: Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP requestNVD（米国 NIST）
2026-10-31CVSS 9.2CVE-2026-116238: In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against anNVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-55598: PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through `POST /api/data/add_podcast` in `rust-api/src/NVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-90888: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.NVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-116386: Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.NVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-119526: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.NVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-39738: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.NVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-39732: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.NVD（米国 NIST）
2026-10-31CVSS 9.1CVE-2026-116852: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.NVD（米国 NIST）
2026-10-31CVSS 9.0CVE-2026-118697: In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificatesNVD（米国 NIST）
2026-10-31CVSS 9.0CVE-2026-119978: Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submitNVD（米国 NIST）
2026-10-31CVSS 10.0CVE-2026-112816: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain fNVD（米国 NIST）
2026-10-31CVSS 10.0CVE-2026-61826: Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API kNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-119706: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers caNVD（米国 NIST）
2026-10-31CVSS 9.2CVE-2026-119716: pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates wiNVD（米国 NIST）
2026-10-31CVSS 9.2CVE-2026-119717: pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a temNVD（米国 NIST）
2026-10-31CVSS 10.0CVE-2026-61738: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/app/integrations/scoutsuite/routes/scoutsuitNVD（米国 NIST）
2026-10-31CVSS 9.9CVE-2026-61728: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_useNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-110799: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficNVD（米国 NIST）
2026-10-31CVSS 9.8CVE-2026-61737: ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warninNVD（米国 NIST）
2026-10-31CVSS 9.4CVE-2026-61729: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptorNVD（米国 NIST）
2026-10-31CVSS 9.4CVE-2026-93327: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrarNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-119660: MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign aNVD（米国 NIST）
2026-10-31CVSS 9.3CVE-2026-61730: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposeNVD（米国 NIST）
2026-10-31CVSS 9.0CVE-2026-112905: Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwNVD（米国 NIST）
2026-10-30CVSS 9.3CVE-2026-119597: OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers canNVD（米国 NIST）
2026-10-30CVSS 9.2CVE-2026-119418: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass craftedNVD（米国 NIST）
2026-10-30CVSS 9.2CVE-2026-119419: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collationNVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-119568: vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharingNVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2025-31704: A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting iNVD（米国 NIST）
2026-10-30CVSS 9.5CVE-2026-116366: An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.NVD（米国 NIST）
2026-10-30CVSS 9.4CVE-2026-82104: In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnerability exists whereby an unauthenticated user can directly call LUA functions, bNVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-103039: The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passinNVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-107249: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX allows Object Injection. This issue affects Block AJAX versions: from 0.0.0 to 3.0.2.NVD（米国 NIST）
2026-10-30CVSS 9.6CVE-2026-119261: Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-30CVSS 9.6CVE-2026-119263: Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: HigNVD（米国 NIST）
2026-10-30Exploited (KEV)Ivanti Connect Secure: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityCISA KEV（悪用確認）
2026-10-30Exploited (KEV)Ivanti Connect Secure: Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityCISA KEV（悪用確認）
2026-10-30CVSS 9.3CVE-2023-22793: A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-61645: Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or tNVD（米国 NIST）
2026-10-30CVSS 9.0CVE-2026-61707: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilegeNVD（米国 NIST）
2026-10-30CVSS 9.4CVE-2026-103093: ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictionsNVD（米国 NIST）
2026-10-30CVSS 9.2CVE-2026-118769: Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botan_block_cipher_block_size converted a size_t block size to int without a bounds check. In an application that accepts external alNVD（米国 NIST）
2026-10-30CVSS 9.3CVE-2026-118762: Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/fix-formatting.yml workflow runs on pull_request_target with repository write permissions, checks out a fork pull requestNVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-107058: An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107060: Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.NVD（米国 NIST）
2026-10-30CVSS 9.9CVE-2026-90868: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-93680: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-90863: Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potNVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-90864: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-90866: A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentiaNVD（米国 NIST）
2026-10-30CVSS 9.0CVE-2026-90865: An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.NVD（米国 NIST）
2026-10-30CVSS 10.0CVE-2026-84295: Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credeNVD（米国 NIST）
2026-10-30CVSS 10.0CVE-2026-61991: Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-54856: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-54857: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-54858: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-54859: Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-54860: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-61992: Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-61997: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-61998: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62001: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62002: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62003: Unauthenticated PHP Object Injection in Mission <= 1.22 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62004: Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62005: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62006: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62008: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62009: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62010: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62011: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62012: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62013: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62014: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62015: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62016: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62017: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62018: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-62131: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.NVD（米国 NIST）
2026-10-30CVSS 9.4CVE-2026-119145: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can uploaNVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can cNVD（米国 NIST）
2026-10-30CVSS 9.9CVE-2026-107327: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.NVD（米国 NIST）
2026-10-30CVSS 9.9CVE-2026-107328: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.NVD（米国 NIST）
2026-10-30CVSS 9.9CVE-2026-107329: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-104339: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.NVD（米国 NIST）
2026-10-30CVSS 9.8CVE-2026-110186: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.NVD（米国 NIST）
2026-10-30CVSS 9.3CVE-2026-111732: P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copyNVD（米国 NIST）
2026-10-30CVSS 9.2CVE-2026-112256: Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced AuthenticatNVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107032: Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107028: Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107034: Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107015: Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.NVD（米国 NIST）
2026-10-30CVSS 9.1CVE-2026-107017: Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.NVD（米国 NIST）
2026-10-29CVSS 9.2CVE-2026-119050: Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompNVD（米国 NIST）
2026-10-29CVSS 9.3CVE-2026-97854: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.NVD（米国 NIST）
2026-10-29CVSS 9.3CVE-2026-115964: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors:NVD（米国 NIST）
2026-10-29CVSS 9.3CVE-2026-114358: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attackerNVD（米国 NIST）
2026-10-29CVSS 9.9CVE-2026-113617: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to rNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-113616: The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-115245: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, iNVD（米国 NIST）
2026-10-29CVSS 9.0CVE-2026-103693: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when aNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-109516: The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpointNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-42922: A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticatedNVD（米国 NIST）
2026-10-29CVSS 9.4CVE-2026-66088: In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create orNVD（米国 NIST）
2026-10-29Exploited (KEV)GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityCISA KEV（悪用確認）
2026-10-29Exploited (KEV)Cisco Secure Firewall ASA Software and Cisco Secure FTD Software: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference VulnerabilityCISA KEV（悪用確認）
2026-10-29CVSS 10.0CVE-2026-61564: AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootNVD（米国 NIST）
2026-10-29CVSS 10.0CVE-2026-61567: AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts thNVD（米国 NIST）
2026-10-29CVSS 9.3CVE-2026-118690: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretNVD（米国 NIST）
2026-10-29CVSS 9.3electrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itGitHub Advisory（pip）
2026-10-29CVSS 9.3electrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itGitHub Advisory（pip）
2026-10-29CVSS 9.9wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionGitHub Advisory（rust）
2026-10-29CVSS 9.9wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionGitHub Advisory（rust）
2026-10-29CVSS 10.0zip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEGitHub Advisory（rust）
2026-10-29CVSS 10.0zip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEGitHub Advisory（rust）
2026-10-29CVSS 9.4CVE-2026-63190: FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` autheNVD（米国 NIST）
2026-10-29CVSS 9.1CVE-2026-117574: A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. BecauNVD（米国 NIST）
2026-10-29CVSS 9.2CVE-2026-118633: A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes whenNVD（米国 NIST）
2026-10-29CVSS 9.1CVE-2026-118264: Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If tNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-103406: An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root viNVD（米国 NIST）
2026-10-29CVSS 9.8CVE-2026-103409: A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parametersNVD（米国 NIST）
2026-10-29CVSS 9.9CVE-2026-44179: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and execuNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-115968: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.NVD（米国 NIST）
2026-10-28CVSS 9.4CVE-2026-105420: Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write fileNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-115904: Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExNVD（米国 NIST）
2026-10-28CVSS 9.3CVE-2026-111411: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit AutomationNVD（米国 NIST）
2026-10-28CVSS 9.3CVE-2026-115607: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.NVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-67074: HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-114278: The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "...NVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-103780: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 througNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-103792: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versiNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-103799: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versiNVD（米国 NIST）
2026-10-28CVSS 9.4CVE-2026-112197: Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An attacker with network access to the service can invoke remote methods without authentication, obtainNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-86384: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 througNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-14571: A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by anNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-86397: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 througNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-86400: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 througNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-90717: Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versiNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-109218: The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-103688: The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types setting is left empty, which it documents as the way to accept all files, allowinNVD（米国 NIST）
2026-10-28CVSS 9.4CVE-2026-104383: Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injectionNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-84999: The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file tyNVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-118375: llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-106013: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler in all versions up to and including 4.61.0. The vulnerability exists within the verify_twitter_callbacNVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-110879: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct typeNVD（米国 NIST）
2026-10-28Exploited (KEV)Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging VulnerabilityCISA KEV（悪用確認）
2026-10-28Exploited (KEV)Linux Kernel: Linux Kernel Missing Initialization of a Variable VulnerabilityCISA KEV（悪用確認）
2026-10-28CVSS 9.6CVE-2026-118316: Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118321: Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security seveNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118332: Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: HNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118340: Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118342: Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118355: Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-58256: GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filterNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118305: Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118306: Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118308: Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)NVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118309: Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severiNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118310: Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sevNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-118312: Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)NVD（米国 NIST）
2026-10-28CVSS 9.8CVE-2026-116692: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts reqNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-112352: Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing onlyNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-48360: Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulNVD（米国 NIST）
2026-10-28CVSS 10.0CVE-2026-105781: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the currenNVD（米国 NIST）
2026-10-28CVSS 9.9CVE-2026-104351: Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged atNVD（米国 NIST）
2026-10-28CVSS 9.9CVE-2026-104353: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of theNVD（米国 NIST）
2026-10-28CVSS 9.9CVE-2026-105489: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the currenNVD（米国 NIST）
2026-10-28CVSS 9.9CVE-2026-105780: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerabNVD（米国 NIST）
2026-10-28CVSS 9.3CVE-2026-104350: Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated accNVD（米国 NIST）
2026-10-28CVSS 9.3CVE-2026-114595: In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corrupNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-104354: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the currenNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-105779: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attackerNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-108014: Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. AnNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-108015: Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An uNVD（米国 NIST）
2026-10-28CVSS 9.1CVE-2026-108142: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.NVD（米国 NIST）
2026-10-28CVSS 9.0CVE-2026-106076: A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuratNVD（米国 NIST）
2026-10-28CVSS 9.6CVE-2026-116863: Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through 4.18.2.NVD（米国 NIST）
2026-10-28CVSS 9.5CVE-2026-103594: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the-middle TLS-decrypted access between the Firebox and WatchGuard Cloud to createNVD（米国 NIST）
2026-10-28CVSS 9.4CVE-2026-90465: A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privilegedNVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-112709: A heap-based buffer overflow vulnerability in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service conditionNVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-112710: A heap-based buffer overflow vulnerability exists in the Fireware OS authentication service allows an attacker who controls or intercepts traffic to the configured Active Directory server to create a denial of service coNVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-93857: A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.NVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-93865: A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially craftNVD（米国 NIST）
2026-10-28CVSS 9.2CVE-2026-93866: An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a speNVD（米国 NIST）

Languages & packages (7 days)

DateItemSource
2026-11-03Announcing new Security Developer at the PSFPython（PSF）
2026-11-03CVSS 6.1@bytebase/dbhub: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationGitHub Advisory（npm）
2026-11-03CVSS 6.1@bytebase/dbhub: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationGitHub Advisory（npm）
2026-11-03CVSS 7.1@sd-jwt/core, @sd-jwt/decode: SD JWT JS: Tampered disclosures silently dropped instead of rejectedGitHub Advisory（npm）
2026-11-03CVSS 7.1@sd-jwt/core, @sd-jwt/decode: SD JWT JS: Tampered disclosures silently dropped instead of rejectedGitHub Advisory（npm）
2026-10-31CVSS 7.5github.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsGitHub Advisory（go）
2026-10-31CVSS 7.1pypdf: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage when parsing page treeGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage when parsing page treeGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible infinite loop when cloning dictionariesGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible infinite loop when cloning dictionariesGitHub Advisory（pip）
2026-10-31CVSS 7.5@hapi/joi, joi: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceGitHub Advisory（npm）
2026-10-31CVSS 7.5@hapi/content, content: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of serviceGitHub Advisory（npm）
2026-10-31CVSS 7.5@hapi/joi, joi: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceGitHub Advisory（npm）
2026-10-31CVSS 7.5@hapi/content, content: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of serviceGitHub Advisory（npm）
2026-10-31CVSS 8.8Authlib: Authlib RFC 7592 examples omit registration-access-token client bindingGitHub Advisory（pip）
2026-10-31CVSS 8.8Authlib: Authlib RFC 7592 examples omit registration-access-token client bindingGitHub Advisory（pip）
2026-10-31CVSS 6.9minimatch: minimatch has potential denial of service via globparts amplificationGitHub Advisory（npm）
2026-10-31CVSS 6.9minimatch: minimatch has potential denial of service via globparts amplificationGitHub Advisory（npm）
2026-10-31CVSS 6.3glob: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalGitHub Advisory（npm）
2026-10-31CVSS 6.3glob: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalGitHub Advisory（npm）
2026-10-31CVSS 7.1pypdf: pypdf has possible long runtimes when retrieving page labelsGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage for exceptions in strict modeGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible long runtimes/large memory usage for encrypted PDF filesGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible long runtimes when retrieving page labelsGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage for exceptions in strict modeGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible long runtimes/large memory usage for encrypted PDF filesGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage when parsing cross-reference streamsGitHub Advisory（pip）
2026-10-31CVSS 7.1pypdf: pypdf has possible large memory usage when parsing cross-reference streamsGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic-complexity denial of service in binary REAL decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic-complexity denial of service in binary REAL decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5pyasn1: pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingGitHub Advisory（pip）
2026-10-31CVSS 7.5node-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)GitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countGitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageGitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)GitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countGitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageGitHub Advisory（npm）
2026-10-31CVSS 5.9node-forge: Forge: TLS client crash when the server sends no certificateGitHub Advisory（npm）
2026-10-31CVSS 5.9node-forge: Forge: AES-GCM authentication bypass via unvalidated tagLength optionGitHub Advisory（npm）
2026-10-31CVSS 5.9node-forge: Forge: TLS client crash when the server sends no certificateGitHub Advisory（npm）
2026-10-31CVSS 5.9node-forge: Forge: AES-GCM authentication bypass via unvalidated tagLength optionGitHub Advisory（npm）
2026-10-31CVSS 4.8node-forge: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieGitHub Advisory（npm）
2026-10-31CVSS 4.8node-forge: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieGitHub Advisory（npm）
2026-10-31CVSS 3.7node-forge: Forge: ASN.1 OID first arc truncation in asn1.oidToDerGitHub Advisory（npm）
2026-10-31CVSS 3.7node-forge: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeGitHub Advisory（npm）
2026-10-31CVSS 3.7node-forge: Forge: ASN.1 OID first arc truncation in asn1.oidToDerGitHub Advisory（npm）
2026-10-31CVSS 3.7node-forge: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeGitHub Advisory（npm）
2026-10-31CVSS 2.9node-forge: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)GitHub Advisory（npm）
2026-10-31CVSS 2.9node-forge: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)GitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: Denial of service in TLS record processing via call stack exhaustionGitHub Advisory（npm）
2026-10-31CVSS 7.5node-forge: Forge: Denial of service in TLS record processing via call stack exhaustionGitHub Advisory（npm）
2026-10-31CVSS 7.4node-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13GitHub Advisory（npm）
2026-10-31CVSS 7.4node-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13GitHub Advisory（npm）
2026-10-31CVSS 5.4phpunit/phpunit: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingGitHub Advisory（composer）
2026-10-31CVSS 5.4phpunit/phpunit: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingGitHub Advisory（composer）
2026-10-31CVSS 4.8@nuxt/vite-builder: Nuxt dev server exposes generated appSecret through Vite file servingGitHub Advisory（npm）
2026-10-31CVSS 4.8@nuxt/vite-builder: Nuxt dev server exposes generated appSecret through Vite file servingGitHub Advisory（npm）
2026-10-31CVSS 7.4@sigstore/oci: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload LocationGitHub Advisory（npm）
2026-10-31CVSS 7.4@sigstore/oci: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload LocationGitHub Advisory（npm）
2026-10-31CVSS 6.5@nuxt/nitro-server, nuxt: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesGitHub Advisory（npm）
2026-10-31CVSS 6.5@nuxt/nitro-server, nuxt: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesGitHub Advisory（npm）
2026-10-31CVSS 5.9@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reportsGitHub Advisory（npm）
2026-10-31CVSS 5.9@nuxt/vite-builder: Nuxt dev server exposes private runtime config through the Nitro dev bundleGitHub Advisory（npm）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsGitHub Advisory（maven）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsGitHub Advisory（maven）
2026-10-31CVSS 5.9@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reportsGitHub Advisory（npm）
2026-10-31CVSS 5.9@nuxt/vite-builder: Nuxt dev server exposes private runtime config through the Nitro dev bundleGitHub Advisory（npm）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsGitHub Advisory（maven）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsGitHub Advisory（maven）
2026-10-31CVSS 3.7org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengthsGitHub Advisory（maven）
2026-10-31CVSS 3.7org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengthsGitHub Advisory（maven）
2026-10-31CVSS 8.3russh: russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationGitHub Advisory（rust）
2026-10-31CVSS 8.3russh: russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationGitHub Advisory（rust）
2026-10-31CVSS 8.2follow-redirects: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsGitHub Advisory（npm）
2026-10-31CVSS 8.2follow-redirects: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsGitHub Advisory（npm）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client filesGitHub Advisory（maven）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingGitHub Advisory（maven）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client filesGitHub Advisory（maven）
2026-10-31CVSS 5.9org.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingGitHub Advisory（maven）
2026-10-31CVSS 2.3pageant: pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)GitHub Advisory（rust）
2026-10-31CVSS 2.3pageant: pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)GitHub Advisory（rust）
2026-10-31CVSS 8.4oauthlib: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientGitHub Advisory（pip）
2026-10-31CVSS 8.4oauthlib: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientGitHub Advisory（pip）
2026-10-31CVSS 7.5graphql-core: GraphQL-core has denial of service via memory leak in aborted validationsGitHub Advisory（pip）
2026-10-31CVSS 7.5graphql-core: GraphQL-core has denial of service via memory leak in aborted validationsGitHub Advisory（pip）
2026-10-31CVSS 5.9github.com/gofiber/fiber/v2: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGitHub Advisory（go）
2026-10-31CVSS 5.9github.com/gofiber/fiber/v2: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGitHub Advisory（go）
2026-10-31CVSS 5.3openwisp-controller: OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsGitHub Advisory（pip）
2026-10-31CVSS 5.3openwisp-controller: OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsGitHub Advisory（pip）
2026-10-31CVSS 4.3russh: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)GitHub Advisory（rust）
2026-10-31CVSS 4.3russh: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsGitHub Advisory（rust）
2026-10-31CVSS 4.3russh: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)GitHub Advisory（rust）
2026-10-31CVSS 4.3russh: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsGitHub Advisory（rust）
2026-10-31CVSS 3.3russh: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesGitHub Advisory（rust）
2026-10-31CVSS 3.3russh: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesGitHub Advisory（rust）
2026-10-31CVSS 9.8@signalk/resources-provider, signalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionGitHub Advisory（npm）
2026-10-31CVSS 9.8github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGitHub Advisory（go）
2026-10-31CVSS 9.8@signalk/resources-provider, signalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionGitHub Advisory（npm）
2026-10-31CVSS 9.8github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2, github.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGitHub Advisory（go）
2026-10-31CVSS 4.2signalk-server: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherGitHub Advisory（npm）
2026-10-31CVSS 4.2signalk-server: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherGitHub Advisory（npm）
2026-10-31CVSS 7.5github.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldGitHub Advisory（go）
2026-10-31CVSS 7.5github.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldGitHub Advisory（go）
2026-10-31CVSS 6.5github.com/anacrolix/torrent: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSGitHub Advisory（go）
2026-10-31CVSS 6.5github.com/anacrolix/torrent: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoSGitHub Advisory（go）
2026-10-31CVSS 6.9adminneo-org/adminneo: AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCEGitHub Advisory（composer）
2026-10-31CVSS 6.9adminneo-org/adminneo: AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCEGitHub Advisory（composer）
2026-10-31CVSS 8.2adminneo-org/adminneo: AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersGitHub Advisory（composer）
2026-10-31CVSS 8.2adminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)GitHub Advisory（composer）
2026-10-31CVSS 8.2adminneo-org/adminneo: AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersGitHub Advisory（composer）
2026-10-31CVSS 8.2adminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)GitHub Advisory（composer）
2026-10-31CVSS 8.1adminneo-org/adminneo: AdminNeo SQLite Database-List Drop Arbitrary File DeletionGitHub Advisory（composer）
2026-10-31CVSS 8.1adminneo-org/adminneo: AdminNeo SQLite Database-List Drop Arbitrary File DeletionGitHub Advisory（composer）
2026-10-31CVSS 7.2adminneo-org/adminneo: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)GitHub Advisory（composer）
2026-10-31CVSS 7.2adminneo-org/adminneo: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)GitHub Advisory（composer）
2026-10-31CVSS 6.8adminneo-org/adminneo: AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request ForgeryGitHub Advisory（composer）
2026-10-31CVSS 6.8adminneo-org/adminneo: AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request ForgeryGitHub Advisory（composer）
2026-10-31CVSS 4.8gov.nsa.emissary:emissary: NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571GitHub Advisory（maven）
2026-10-31CVSS 4.8gov.nsa.emissary:emissary: NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571GitHub Advisory（maven）
2026-10-31CVSS 9.3pypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIGitHub Advisory（actions）
2026-10-31CVSS 9.3pypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPIGitHub Advisory（actions）
2026-10-31CVSS 7.5adminneo-org/adminneo: AdminNeo: version-cache array injection causes persistent denial of serviceGitHub Advisory（composer）
2026-10-31CVSS 7.5adminneo-org/adminneo: AdminNeo: version-cache array injection causes persistent denial of serviceGitHub Advisory（composer）
2026-10-30CVSS 7.5joserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionGitHub Advisory（pip）
2026-10-30CVSS 7.5joserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionGitHub Advisory（pip）
2026-10-30CVSS 6.9joserfc: joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionGitHub Advisory（pip）
2026-10-30CVSS 6.9joserfc: joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionGitHub Advisory（pip）
2026-10-30CVSS 5.9github.com/charmbracelet/soft-serve: charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGitHub Advisory（go）
2026-10-30CVSS 5.9github.com/charmbracelet/soft-serve: charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGitHub Advisory（go）
2026-10-30CVSS 7.3@nx/gradle, @nx/maven: @nx/maven and @nx/gradle have OS command injection via nx.json plugin optionsGitHub Advisory（npm）
2026-10-30CVSS 7.3@nx/gradle, @nx/maven: @nx/maven and @nx/gradle have OS command injection via nx.json plugin optionsGitHub Advisory（npm）
2026-10-30CVSS 5.3github.com/charmbracelet/soft-serve: charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesGitHub Advisory（go）
2026-10-30CVSS 5.3github.com/charmbracelet/soft-serve: charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesGitHub Advisory（go）
2026-10-30CVSS 8.2decode-uri-component: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsGitHub Advisory（npm）
2026-10-30CVSS 8.2decode-uri-component: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsGitHub Advisory（npm）
2026-10-30CVSS 7.5Twisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream ResetGitHub Advisory（pip）
2026-10-30CVSS 7.5Twisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream ResetGitHub Advisory（pip）
2026-10-30CVSS 7.5zip: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeGitHub Advisory（rust）
2026-10-30CVSS 7.5zip: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionGitHub Advisory（rust）
2026-10-30CVSS 7.5zip: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeGitHub Advisory（rust）
2026-10-30CVSS 7.5zip: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionGitHub Advisory（rust）
2026-10-30CVSS 7.4zip: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.GitHub Advisory（rust）
2026-10-30CVSS 7.4zip: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.GitHub Advisory（rust）
2026-10-30CVSS 6.5zip: zip: AES Entry HMAC Authentication Bypass on Premature EOFGitHub Advisory（rust）
2026-10-30CVSS 6.5zip: zip: AES Entry HMAC Authentication Bypass on Premature EOFGitHub Advisory（rust）
2026-10-30CVSS 7.6shopify_app: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsGitHub Advisory（rubygems）
2026-10-30CVSS 7.6shopify_app: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsGitHub Advisory（rubygems）
2026-10-30CVSS 7.3github.com/cert-manager/cert-manager: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsGitHub Advisory（go）
2026-10-30CVSS 7.3org.keycloak:keycloak-services: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassGitHub Advisory（maven）
2026-10-30CVSS 7.3github.com/cert-manager/cert-manager: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsGitHub Advisory（go）
2026-10-30CVSS 7.3org.keycloak:keycloak-services: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassGitHub Advisory（maven）
2026-10-30CVSS 6.9vite: Vite: `server.fs.deny` bypassed with queriesGitHub Advisory（npm）
2026-10-30CVSS 6.9vite: Vite: `server.fs.deny` bypassed with queriesGitHub Advisory（npm）
2026-10-30CVSS 4.9org.keycloak:keycloak-services: Keycloak vulnerable to information disclosure through arbitrary filesystem path probingGitHub Advisory（maven）
2026-10-30CVSS 4.9org.keycloak:keycloak-services: Keycloak vulnerable to information disclosure through arbitrary filesystem path probingGitHub Advisory（maven）
2026-10-30CVSS 8.1org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services: Keycloak vulnerable to authorization bypass via incorrect uri comparisonGitHub Advisory（maven）
2026-10-30CVSS 8.1org.keycloak:keycloak-policy-enforcer, org.keycloak:keycloak-services: Keycloak vulnerable to authorization bypass via incorrect uri comparisonGitHub Advisory（maven）
2026-10-30CVSS 4.6org.keycloak:keycloak-services: Keycloak allows unauthorized access to resources via uma permission ticket bypassGitHub Advisory（maven）
2026-10-30CVSS 4.6org.keycloak:keycloak-services: Keycloak allows unauthorized access to resources via uma permission ticket bypassGitHub Advisory（maven）
2026-10-30CVSS 6.5org.keycloak:keycloak-services: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenGitHub Advisory（maven）
2026-10-30CVSS 6.5org.keycloak:keycloak-services: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenGitHub Advisory（maven）
2026-10-30CVSS 8.2@eeacms/volto-chatbot: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy ProxyGitHub Advisory（npm）
2026-10-30CVSS 8.2@eeacms/volto-chatbot: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy ProxyGitHub Advisory（npm）
2026-10-30CVSS 6.3crass: Crass: Non-ASCII characters cause superlinear CPU consumptionGitHub Advisory（rubygems）
2026-10-30CVSS 6.3crass: Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorGitHub Advisory（rubygems）
2026-10-30CVSS 6.3crass: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageGitHub Advisory（rubygems）
2026-10-30CVSS 6.3crass: Crass: Non-ASCII characters cause superlinear CPU consumptionGitHub Advisory（rubygems）
2026-10-30CVSS 6.3crass: Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorGitHub Advisory（rubygems）
2026-10-30CVSS 6.3crass: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageGitHub Advisory（rubygems）
2026-10-30CVSS 2.1@cedar-policy/cedar-wasm, cedar-policy: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceGitHub Advisory（npm・rust）
2026-10-30CVSS 2.1@cedar-policy/cedar-wasm, cedar-policy: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceGitHub Advisory（npm・rust）
2026-10-30CVSS 7.5@sylphx/pdf-reader-mcp: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYGitHub Advisory（npm）
2026-10-30CVSS 7.5@sylphx/pdf-reader-mcp: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYGitHub Advisory（npm）
2026-10-30CVSS 7.3praisonai: PraisonAI vulnerable to Remote Code Execution via Broken AST SandboxGitHub Advisory（pip）
2026-10-30CVSS 7.3praisonai: PraisonAI vulnerable to Remote Code Execution via Broken AST SandboxGitHub Advisory（pip）
2026-10-30CVSS 8.7github.com/daptin/daptin: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGitHub Advisory（go）
2026-10-30CVSS 8.7github.com/daptin/daptin: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGitHub Advisory（go）
2026-10-30CVSS 2.1parse-server: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklistGitHub Advisory（npm）
2026-10-30CVSS 2.1parse-server: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklistGitHub Advisory（npm）
2026-10-30CVSS 4.2silverstripe/mfa: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flowGitHub Advisory（composer）
2026-10-30CVSS 4.2silverstripe/mfa: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flowGitHub Advisory（composer）
2026-10-30CVSS 2.3pocketmine/pocketmine-mp: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packetsGitHub Advisory（composer）
2026-10-30CVSS 2.3pocketmine/pocketmine-mp: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packetsGitHub Advisory（composer）
2026-10-29Announcing PSF Community Service Award Recipients!Python（PSF）
2026-10-29CVSS 5.3tornado: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksGitHub Advisory（pip）
2026-10-29CVSS 5.3tornado: Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingGitHub Advisory（pip）
2026-10-29CVSS 5.3tornado: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksGitHub Advisory（pip）
2026-10-29CVSS 5.3tornado: Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingGitHub Advisory（pip）
2026-10-29CVSS 2.1tornado: Tornado: Open redirect in RedirectHandler via protocol-relative URLsGitHub Advisory（pip）
2026-10-29CVSS 2.1tornado: Tornado: Open redirect in RedirectHandler via protocol-relative URLsGitHub Advisory（pip）
2026-10-29CVSS 7.8systeminformation: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marksGitHub Advisory（npm）
2026-10-29CVSS 7.8systeminformation: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marksGitHub Advisory（npm）
2026-10-29CVSS 6.5@backstage/plugin-catalog-backend: Backstage catalog rules can be bypassed for URL locations using encoded path segmentsGitHub Advisory（npm）
2026-10-29CVSS 6.5@backstage/plugin-catalog-backend: Backstage catalog rules can be bypassed for URL locations using encoded path segmentsGitHub Advisory（npm）
2026-10-29CVSS 5.3crass: Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassGitHub Advisory（rubygems）
2026-10-29CVSS 5.3crass: Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassGitHub Advisory（rubygems）
2026-10-29CVSS 9.3electrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itGitHub Advisory（pip）
2026-10-29CVSS 9.3electrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itGitHub Advisory（pip）
2026-10-29CVSS 6.5knative.dev/pkg: knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionGitHub Advisory（go）
2026-10-29CVSS 6.5knative.dev/pkg: knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionGitHub Advisory（go）
2026-10-29CVSS 7.5seroval: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)GitHub Advisory（npm）
2026-10-29CVSS 7.5seroval: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthGitHub Advisory（npm）
2026-10-29CVSS 7.5seroval: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)GitHub Advisory（npm）
2026-10-29CVSS 7.5seroval: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthGitHub Advisory（npm）
2026-10-29CVSS 7.3seroval: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkGitHub Advisory（npm）
2026-10-29CVSS 7.3seroval: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkGitHub Advisory（npm）
2026-10-29CVSS 6.5@waline/vercel: Waline login accepts a non-string email as a match-all MongoDB queryGitHub Advisory（npm）
2026-10-29CVSS 6.5@waline/vercel: Waline login accepts a non-string email as a match-all MongoDB queryGitHub Advisory（npm）
2026-10-29CVSS 6.3mem0ai: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)GitHub Advisory（npm・pip）
2026-10-29CVSS 6.3mem0ai: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)GitHub Advisory（npm・pip）
2026-10-29CVSS 5.3seroval: Seroval: Code injection through a typed array's own constructor propertyGitHub Advisory（npm）
2026-10-29CVSS 5.3seroval: Seroval: Code injection through a typed array's own constructor propertyGitHub Advisory（npm）
2026-10-29CVSS 4.7seroval: Seroval: Script injection through RegExp sources in serialized outputGitHub Advisory（npm）
2026-10-29CVSS 4.7seroval: Seroval: Script injection through RegExp sources in serialized outputGitHub Advisory（npm）
2026-10-29CVSS 6.8social-auth-core: Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimGitHub Advisory（pip）
2026-10-29CVSS 6.8social-auth-core: Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required AttributeGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)GitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required AttributeGitHub Advisory（pip）
2026-10-29CVSS 6.2onnx: ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)GitHub Advisory（pip）
2026-10-29CVSS 8.1vllm: vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEGitHub Advisory（pip）
2026-10-29CVSS 8.1vllm: vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCEGitHub Advisory（pip）
2026-10-29CVSS 7.5vllm: vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledGitHub Advisory（pip）
2026-10-29CVSS 7.5vllm: vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engineGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM DeepSeek-OCR image processing vulnerable to denial of serviceGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)GitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engineGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM DeepSeek-OCR image processing vulnerable to denial of serviceGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)GitHub Advisory（pip）
2026-10-29CVSS 3.4vllm: vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP serverGitHub Advisory（pip）
2026-10-29CVSS 3.4vllm: vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP serverGitHub Advisory（pip）
2026-10-29CVSS 9.9wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionGitHub Advisory（rust）
2026-10-29CVSS 9.9wasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionGitHub Advisory（rust）
2026-10-29CVSS 6.9github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4: Go JOSE: Panics in JSON parsingGitHub Advisory（go）
2026-10-29CVSS 6.9github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4: Go JOSE: Panic during CBC-HMAC processingGitHub Advisory（go）
2026-10-29CVSS 6.9github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4: Go JOSE: Panics in JSON parsingGitHub Advisory（go）
2026-10-29CVSS 6.9github.com/go-jose/go-jose/v3, github.com/go-jose/go-jose/v4: Go JOSE: Panic during CBC-HMAC processingGitHub Advisory（go）
2026-10-29CVSS 6.5vllm: vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsGitHub Advisory（pip）
2026-10-29CVSS 6.5vllm: vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolGitHub Advisory（pip）
2026-10-29CVSS 7.5graphql-scalars: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of serviceGitHub Advisory（npm）
2026-10-29CVSS 7.5graphql-scalars: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of serviceGitHub Advisory（npm）
2026-10-29CVSS 6.5systeminformation: systeminformation has prototype pollution in `networkStats()` via the interface nameGitHub Advisory（npm）
2026-10-29CVSS 6.5systeminformation: systeminformation has prototype pollution in `networkStats()` via the interface nameGitHub Advisory（npm）
2026-10-29CVSS 4.1langgraph-cli: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputGitHub Advisory（pip）
2026-10-29CVSS 4.1langgraph-cli: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputGitHub Advisory（pip）
2026-10-29CVSS 3.3systeminformation: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netGitHub Advisory（npm）
2026-10-29CVSS 3.3systeminformation: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netGitHub Advisory（npm）
2026-10-29CVSS 7.5re2js: RE2JS: Quadratic-time denial of service in re2js lookbehind matchingGitHub Advisory（npm）
2026-10-29CVSS 7.5re2js: RE2JS: Quadratic-time denial of service in re2js lookbehind matchingGitHub Advisory（npm）
2026-10-29CVSS 5.9autobahn: Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)GitHub Advisory（pip）
2026-10-29CVSS 5.9autobahn: Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)GitHub Advisory（pip）
2026-10-29CVSS 3.7i18next-http-backend: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringGitHub Advisory（npm）
2026-10-29CVSS 3.7i18next-http-backend: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringGitHub Advisory（npm）
2026-10-29CVSS 10.0zip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEGitHub Advisory（rust）
2026-10-29CVSS 10.0zip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEGitHub Advisory（rust）
2026-10-29CVSS 8.6langgraph-api: LangGraph JavaScript custom authentication may permit cross-user Store accessGitHub Advisory（pip）
2026-10-29CVSS 8.6langgraph-api: LangGraph JavaScript custom authentication may permit cross-user Store accessGitHub Advisory（pip）
2026-10-29CVSS 5.3filelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdGitHub Advisory（pip）
2026-10-29CVSS 5.3filelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live holdGitHub Advisory（pip）
2026-10-29CVSS 3.3filelock: filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockGitHub Advisory（pip）
2026-10-29CVSS 3.3filelock: filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockGitHub Advisory（pip）
2026-10-29CVSS 6.3filelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionGitHub Advisory（pip）
2026-10-29CVSS 6.3filelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLiteGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLiteGitHub Advisory（pip）
2026-10-29CVSS 6.1filelock: filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordGitHub Advisory（pip）
2026-10-29CVSS 5.8filelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesGitHub Advisory（pip）
2026-10-29CVSS 5.8filelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user choosesGitHub Advisory（pip）
2026-10-29CVSS 5.5filelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutGitHub Advisory（pip）
2026-10-29CVSS 5.5filelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutGitHub Advisory（pip）
2026-10-29CVSS 5.3filelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLGitHub Advisory（pip）
2026-10-29CVSS 5.3filelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLGitHub Advisory（pip）
2026-10-29CVSS 4.7filelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerGitHub Advisory（pip）
2026-10-29CVSS 4.7filelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersGitHub Advisory（pip）
2026-10-29CVSS 4.7filelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerGitHub Advisory（pip）
2026-10-29CVSS 4.7filelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersGitHub Advisory（pip）
2026-10-29CVSS 2.5filelock: filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerGitHub Advisory（pip）
2026-10-29CVSS 2.5filelock: filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerGitHub Advisory（pip）
2026-10-29CVSS 5.3io.opentelemetry:opentelemetry-api: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingGitHub Advisory（maven）
2026-10-29CVSS 5.3io.opentelemetry:opentelemetry-api: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingGitHub Advisory（maven）
2026-10-29CVSS 3.1i18next-http-backend: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)GitHub Advisory（npm）
2026-10-29CVSS 3.1i18next-http-backend: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)GitHub Advisory（npm）
2026-10-29CVSS 8.6happy-dom: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.6happy-dom: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLGitHub Advisory（npm）
2026-10-29CVSS 7.2@intlify/core, @intlify/core-base, @intlify/shared: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesGitHub Advisory（npm）
2026-10-29CVSS 7.2@intlify/core, @intlify/core-base, @intlify/shared: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesGitHub Advisory（npm）
2026-10-29CVSS 6.5happy-dom: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesGitHub Advisory（npm）
2026-10-29CVSS 6.5happy-dom: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesGitHub Advisory（npm）
2026-10-29CVSS 2.1@intlify/core, @intlify/core-base, @intlify/vue-i18n-core: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listGitHub Advisory（npm）
2026-10-29CVSS 2.1@intlify/core, @intlify/core-base, @intlify/vue-i18n-core: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listGitHub Advisory（npm）
2026-10-29CVSS 8.2@graphql-tools/executor-legacy-ws: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsGitHub Advisory（npm）
2026-10-29CVSS 8.2@graphql-tools/executor-legacy-ws: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsGitHub Advisory（npm）
2026-10-29CVSS 6.0@graphql-tools/executor-legacy-ws: GraphQL Tools: Shared legacy executor routes one subscription's results to a different callerGitHub Advisory（npm）
2026-10-29CVSS 6.0@graphql-tools/executor-legacy-ws: GraphQL Tools: Shared legacy executor routes one subscription's results to a different callerGitHub Advisory（npm）
2026-10-29CVSS 5.3@hono/node-server: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsGitHub Advisory（npm）
2026-10-29CVSS 5.3@hono/node-server: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsGitHub Advisory（npm）
2026-10-29CVSS 4.3langgraph, langgraph-sdk: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsGitHub Advisory（pip）
2026-10-29CVSS 4.3langgraph, langgraph-sdk: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsGitHub Advisory（pip）
2026-10-29CVSS 6.1github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURIGitHub Advisory（go）
2026-10-29CVSS 6.1github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURIGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversalGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path TraversalGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme HeadersGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversalGitHub Advisory（go）
2026-10-29CVSS 5.9github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path TraversalGitHub Advisory（go）
2026-10-29CVSS 4.7github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoGitHub Advisory（go）
2026-10-29CVSS 4.7github.com/labstack/echo/v4, github.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-ProtoGitHub Advisory（go）
2026-10-29CVSS 8.6@highcharts/grid-lite, @highcharts/grid-pro: Highcharts Grid parses pagination language options as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.6@highcharts/grid-lite, @highcharts/grid-pro: Highcharts Grid parses pagination language options as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards, @highcharts/grid-pro: Highcharts Grid: `javascript:` URL in credits.href runs script on clickGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards: Highcharts Dashboards parses fullscreen labels as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards, @highcharts/grid-pro: Highcharts Grid: `javascript:` URL in credits.href runs script on clickGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards: Highcharts Dashboards parses fullscreen labels as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards: Highcharts Dashboards parses sidebar component labels as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.4highcharts: Highcharts: `javascript:` URL in credits.href runs script on clickGitHub Advisory（npm）
2026-10-29CVSS 8.4highcharts: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesGitHub Advisory（npm）
2026-10-29CVSS 8.4@highcharts/dashboards: Highcharts Dashboards parses sidebar component labels as HTMLGitHub Advisory（npm）
2026-10-29CVSS 8.4highcharts: Highcharts: `javascript:` URL in credits.href runs script on clickGitHub Advisory（npm）
2026-10-29CVSS 8.4highcharts: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesGitHub Advisory（npm）
2026-10-29CVSS 7.2highcharts: Highcharts: dotted series.keys paths write to Object.prototypeGitHub Advisory（npm）
2026-10-29CVSS 7.2highcharts: Highcharts: dotted series.keys paths write to Object.prototypeGitHub Advisory（npm）
2026-10-29CVSS 7.1highcharts: Highcharts: series column construction writes to Object.prototypeGitHub Advisory（npm）
2026-10-29CVSS 7.1highcharts: Highcharts: series column construction writes to Object.prototypeGitHub Advisory（npm）

Government, vendor & OS advisories (newest first)

DateItemSource
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Grafana: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Erlangen von AdministratorrechtenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Privilegieneskalation und Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Denial of Service und nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [niedrig] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Xen: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[NEU] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03Progress Software security advisory (AV26-1116)CCCS（カナダ）
2026-11-03[Control systems] Siemens security advisory (AV26-802) – Update 1CCCS（カナダ）
2026-11-03PostgreSQL security advisory (AV26-1115)CCCS（カナダ）
2026-11-03Zyxel security advisory (AV26-1114)CCCS（カナダ）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-11-03[NEU] [mittel] Red Hat Enterprise Linux (cockpit): Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03Artificial intelligence and cyber intrusionNCSC（英国）
2026-11-03[UPDATE] [hoch] Apple iOS, iPadOS, macOS und Safari: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [kritisch] Axis Camera Station und Device Manager: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[NEU] [hoch] xwiki: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-11-03[NEU] [niedrig] Froxlor: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-11-03[NEU] [hoch] TianoCore EDK2: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-03[NEU] [mittel] vllm: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[NEU] [mittel] WSO2 API Manager: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[NEU] [hoch] Barracuda Networks Email Security Gateway und Web Application Firewall: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[NEU] [mittel] IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[NEU] [mittel] IBM Storage Scale: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-03[NEU] [mittel] Red Hat Enterprise Linux (libXi, ghostscript): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[NEU] [niedrig] IBM i: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Denial of ServiceCERT-Bund（BSI）
2026-11-03[NEU] [hoch] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[NEU] [hoch] Absolute Secure Access: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] ffmpeg: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] ffmpeg: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [kritisch] WSO2 API Manager: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat OpenShift Container Platform (kubelet, cri-o, kube-apiserver): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Red Hat OpenShift Service Mesh: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Internet Systems Consortium BIND: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] ImageMagick (pixel cache server): Mehrere Schwachstellen ermöglichen Offenlegung von Informationen oder DoSCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat OpenStack Services auf OpenShift (Nova): Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Asterisk: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Enterprise Linux (pyasn1): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat OpenShift GitOps: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und PrivilegieneskalationCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Golang Go: Mehrere Schwachstellen ermöglichen Manipulation von DateienCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Samsung Android: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] gcc: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Red Hat OpenShift: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[NEU] [hoch] Android Patchday November 2026 (Google Android, Automotive OS and XR): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03USN-8961-1: Linux kernel vulnerabilitiesUbuntu USN
2026-11-03USN-8963-1: Linux kernel (NVIDIA Tegra) vulnerabilitiesUbuntu USN
2026-11-03USN-8959-1: Linux kernel vulnerabilitiesUbuntu USN
2026-11-03USN-8968-1: Linux kernel vulnerabilitiesUbuntu USN
2026-11-03USN-8967-1: Linux kernel (AWS) vulnerabilityUbuntu USN
2026-11-03USN-8960-1: Linux kernel (OEM) vulnerabilitiesUbuntu USN
2026-11-03USN-8966-1: Linux kernel vulnerabilitiesUbuntu USN
2026-11-03USN-8965-1: Linux kernel (BlueField) vulnerabilitiesUbuntu USN
2026-11-03USN-8962-1: Linux kernel (Azure CVM) vulnerabilitiesUbuntu USN
2026-11-03USN-8964-1: Linux kernel vulnerabilitiesUbuntu USN
2026-11-03[UPDATE] [mittel] Red Hat OpenShift GitOps (go-git): Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Asterisk: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] GIMP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Erlang/OTP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Argo CD: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] GIMP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Red Hat Enterprise Linux (pki-core und dogtag-pki): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] IBM QRadar SIEM: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Enterprise Linux (OpenEXR): Schwachstelle ermöglicht Codeausführung und Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Grafana: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Offenlegung von InformationenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] strongSwan: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Erlang/OTP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] RabbitMQ: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Enterprise Linux (pyasn1): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Enterprise Linux (brace-expansion): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Ansible Automation Platform (ansible-core): Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Apache Tomcat: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Red Hat Enterprise Linux (go-billy): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] RabbitMQ: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] RabbitMQ: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Internet Systems Consortium BIND: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [hoch] Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-03Multiples vulnérabilités dans NetApp ONTAP 9 (03 novembre 2026)CERT-FR（ANSSI）
2026-11-03Multiples vulnérabilités dans GLPI (03 novembre 2026)CERT-FR（ANSSI）
2026-11-03Multiples vulnérabilités dans PostgreSQL (03 novembre 2026)CERT-FR（ANSSI）
2026-11-03Multiples vulnérabilités dans Xen (03 novembre 2026)CERT-FR（ANSSI）
2026-11-03Multiples vulnérabilités dans Google Android (03 novembre 2026)CERT-FR（ANSSI）
2026-11-03SUSE Linux security advisory (AV26-1113)CCCS（カナダ）
2026-11-03Barracuda Networks security advisory (AV26-1112)CCCS（カナダ）
2026-11-02Red Hat security advisory (AV26-1111)CCCS（カナダ）
2026-11-02Dell security advisory (AV26-1110)CCCS（カナダ）
2026-11-02Google security advisory (AV26-1109)CCCS（カナダ）
2026-11-02[NEU] [mittel] QT: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Microsoft Azure, Entra und Exchange: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Red Hat Enterprise Linux (perl-yaml, pillow): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [mittel] GStreamer: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[NEU] [hoch] WordPress: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [mittel] ffmpeg: Mehrere Schwachstellen ermöglichen Offenlegung von InformationenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Gitea: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] JetBrains Toolbox App: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] JetBrains (IntelliJ IDEA , PyCharm, PhpStorm, WebStorm, CLion, DataGrip, DataSpell): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Wireshark: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [mittel] phpMyAdmin: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [mittel] PowerDNS: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [kritisch] Linksys Router: Schwachstelle ermöglicht Erlangen von AdministratorrechtenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Apache Wicket: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [mittel] Moodle: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [niedrig] drawio: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[NEU] [mittel] Collabora Online: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Traefik: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [kritisch] Flowise: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des DienstesCERT-Bund（BSI）
2026-11-02[NEU] [UNGEPATCHT] [mittel] GNU libc: Schwachstelle ermöglicht Denial of Service und CodeausführungCERT-Bund（BSI）
2026-11-02[NEU] [niedrig] Microsoft Edge: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-11-02[NEU] [mittel] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] Samsung Exynos: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[NEU] [mittel] FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-02[NEU] [mittel] Red Hat Enterprise Linux (PyJWT): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] GIMP: Schwachstelle ermöglicht Codeausführung und Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Red Hat Enterprise Linux (FreeIPA): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Red Hat Enterprise Linux (mod_auth_openidc): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] expat: Schwachstelle ermöglicht Manipulation von DatenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] pgAdmin: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] libxml2: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] HP HPLIP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] GIMP: Schwachstelle ermöglicht Codeausführung und Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] n8n: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] GIMP Plugins: Mehrere Schwachstellen ermöglichen Codeausführung und DoSCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Red Hat Enterprise Linux (libkcapi): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] util-linux: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] util-linux: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] cURL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Dovecot: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] OPNsense: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] GIMP: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] util-linux: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Oracle Java SE: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Microsoft Developer Tools: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] GIMP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Django: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] pgAdmin: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] GIMP Plugins: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Oracle Java SE: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] rsyslog: Schwachstelle ermöglicht Denial of Service und potenziell CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] NGINX NGINX Plus: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Apache log4j und Log4cxx: Mehrere Schwachstellen ermöglichen Manipulation von DateienCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Red Hat Enterprise Linux (perl-HTTP-Daemon): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit den Rechten des DienstesCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] GIMP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] GIMP: Schwachstelle ermöglicht Codeausführung und Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] util-linux: Schwachstelle ermöglicht Denial of Service und Offenlegung von InformationenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] libexpat: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] NGINX und NGINX Plus: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] vim: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] PuTTY: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] NGINX Open Source und NGINX Plus: Schwachstelle ermöglicht Denial of Service und potenziell CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] libexpat: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] cURL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim (NetBeans): Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] vim: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Apache HTTP Server: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] QT (Declarative module): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] vim (.tar and .zip): Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Roundcube: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] SLF4J: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] FUSE: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit BenutzerrechtenCERT-Bund（BSI）
2026-11-02[NEU] [mittel] Microsoft Visual Studio: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-11-02[NEU] [niedrig] Bitwarden: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[NEU] [hoch] SQLite: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Qt Core QXmlStream parser: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] expat: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] rsyslog: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Roundcube Webmail: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Traefik: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Red Hat Enterprise Linux (OpenEXR): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Mozilla Firefox und Thunderbrid: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Linux Kernel: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] GNU Emacs: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] IBM DB2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Ghostscript: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Django: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [niedrig] ImageMagick: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] Red Hat Enterprise Linux (gvfs): Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02[UPDATE] [mittel] Ghostscript: Schwachstelle ermöglicht Manipulation von Dateien und DoSCERT-Bund（BSI）
2026-11-02[UPDATE] [hoch] IBM App Connect Enterprise: Mehrere SchwachstellenCERT-Bund（BSI）
2026-11-02Linux kernel RCE CVE-2026-98432Fortinet PSIRT
2026-11-02JVN: Core TempのカーネルドライバにおけるIOCTLインタフェースに対するアクセス制御が不十分な脆弱性JPCERT/CC
2026-11-02JVN: Siemens製品に対するアップデート（2026年10月）JPCERT/CC
2026-11-02Bulletin d'actualité CERTFR-2026-ACT-046 (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans Tenable Identity Exposure (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans les produits Synology (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans Redmine (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans Microsoft Edge (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans Ivanti Connect Secure (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans Qnap QNE (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Multiples vulnérabilités dans macmon et NRSW (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Vulnérabilité dans Microsoft Visual Studio (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02Vulnérabilité dans Traefik (02 novembre 2026)CERT-FR（ANSSI）
2026-11-02DSA-6602-1 linux - security updateDebian DSA
2026-11-02DSA-6604-1 incus - security updateDebian DSA
2026-11-02DSA-6603-1 git-annex - security updateDebian DSA
2026-11-02DSA-6605-1 chromium - security updateDebian DSA
2026-11-01DSA-6600-1 vim - security updateDebian DSA
2026-11-01DSA-6601-1 eog - security updateDebian DSA
2026-10-31DSA-6597-1 dpdk - security updateDebian DSA
2026-10-31DSA-6599-1 nss - security updateDebian DSA
2026-10-31Linux security advisory (AV26-1108)CCCS（カナダ）
2026-10-31Dev Channel Update for ChromeOS / ChromeOS FlexGoogle Chrome
2026-10-31Ivanti security advisory (AV26-1035) - Update 2CCCS（カナダ）
2026-10-31MongoDB security advisory (AV26-1107)CCCS（カナダ）
2026-10-31HashiCorp security advisory (AV26-1106)CCCS（カナダ）
2026-10-31Drupal security advisory (AV26-1105)CCCS（カナダ）
2026-10-30[NEU] [mittel] ProFTPD: Mehrere Schwachstellen ermöglichen Manipulation von DateienCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux (pipewire,dbus-broker): Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] OPNsense: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30Chrome Dev for Desktop UpdateGoogle Chrome
2026-10-30[UPDATE] [hoch] vllm: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vllm: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] FasterXML Jackson: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Bouncy Castle: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Apache HttpComponents: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [kritisch] Ruby on Rails: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] ffmpeg: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] ffmpeg: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Roundcube: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux (ruby: net-imap): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] docker: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] nghttp2: Schwachstelle ermöglicht Manipulation von DatenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] RabbitMQ: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] cURL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] CPython: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] dhcpcd: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Ansible Automation Platform: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] CPython: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache HTTP Server: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Synacor Zimbra: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vim: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache Tomcat: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache Tomcat APR/native Connector: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Red Hat Ansible Automation Platform (automation-controller): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Apache Tomcat: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux (golang.org/x/text): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache HTTP Server: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Eclipse Jetty: Schwachstelle ermöglicht Darstellen falscher Informationen und OffenlegungCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux (firewalld, leapp-repository, tesseract): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Python: Schwachstelle ermöglicht Manipulation und Offenlegung von DatenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache Tomcat und Tomcat Native: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Red Hat Ansible Automation Platform: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] GnuTLS: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] VLC: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Red Hat Directory Server und Enterprise Linux (389-ds-base): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [niedrig] ImageMagick: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vllm: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] libxml2 (exsltDynMapFunction): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] OpenSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache Tomcat: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache HTTP Server: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] CPython: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-10-30[UPDATE] [niedrig] libxml2: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[UPDATE] [niedrig] ImageMagick: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Splunk SOAR: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Apache HTTP Server: Mehrere Schwachstellen ermöglichen Manipulation von DatenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] CPython: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] xterm: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] PAM: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Roundcube Webmail: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] vllm: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Mattermost: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-30[NEU] [niedrig] ImageMagick: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[NEU] [UNGEPATCHT] [mittel] dnsmasq: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Red Hat Enterprise Linux (389-ds-base): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [mittel] Apple Xcode: Mehrere Schwachstellen ermöglichen Offenlegung von InformationenCERT-Bund（BSI）
2026-10-30[NEU] [mittel] Composer: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [mittel] QT: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-30[NEU] [hoch] ServiceNow AI Platform: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [mittel] WSO2 API Manager: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [mittel] MariaDB Java Connector: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Veeam Management Pack for System Center: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-30[NEU] [mittel] Adobe Digital Editions: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-10-30[NEU] [mittel] CUPS: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Rancher: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Fleet: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Google Chrome: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-30[NEU] [mittel] Red Hat Enterprise Linux (pillow and aspell): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] pgAdmin: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [UNGEPATCHT] [mittel] Ghostscript: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[NEU] [hoch] Progress Software WS_FTP: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30Chrome Dev for Android UpdateGoogle Chrome
2026-10-30[UPDATE] [mittel] Drupal Module (View Unpublished, Simple OAuth und Domain Login Restrict): Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] TianoCore EDK2 PXE Treiber: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode und DoSCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Red Hat Ansible Automation Platform: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Internet Systems Consortium BIND: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [kritisch] PHP: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache Tomcat: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Microsoft Edge: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Langflow: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] MariaDB: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Eclipse Jetty: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Drupal Core, Gin Admin Theme und Entity List: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] IBM WebSphere Application Server und Application Server Liberty: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] IBM WebSphere Application Server und Liberty: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [kritisch] Drupal Erweiterungen: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] WordPress: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] IBM WebSphere Application Server Liberty: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Bouncy Castle für Java: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] Bouncy Castle: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] Apache HTTP Server: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] SOS GmbH JobScheduler: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-30[UPDATE] [hoch] OpenSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-30[UPDATE] [mittel] KeePassXC: Mehrere Schwachstellen ermöglichen Denial of Service und OffenlegungCERT-Bund（BSI）
2026-10-30JVN: 三菱電機製の複数製品における複数の脆弱性（2026-006）JPCERT/CC
2026-10-30お知らせ：オープンリゾルバー確認サイト長期メンテナンスのお知らせJPCERT/CC
2026-10-30JVN: CISA ICS Advisory / ICS Medical Advisory（2026年10月29日）JPCERT/CC
2026-10-30Multiples vulnérabilités dans les produits IBM (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans les produits Apple (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Vulnérabilité dans Stormshield Management Center (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans Google Chrome (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Vulnérabilité dans CPython (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans le noyau Linux de SUSE (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Vulnérabilité dans Tenable Nessus Plugin (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans le noyau Linux de Red Hat (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans les produits MongoDB (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans Suricata (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Multiples vulnérabilités dans Veeam Management Pack (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Vulnérabilité dans GitLab (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30Vulnérabilité dans Ruby on Rails trilogy (30 octobre 2026)CERT-FR（ANSSI）
2026-10-30DSA-6598-1 thunderbird - security updateDebian DSA
2026-10-30Chrome for Android UpdateGoogle Chrome
2026-10-30Stable Channel Update for DesktopGoogle Chrome
2026-10-30GitLab security advisory (AV26-1028) - Update 1CCCS（カナダ）
2026-10-30USN-8958-1: .NET vulnerabilitiesUbuntu USN
2026-10-30Chrome Beta for iOS UpdateGoogle Chrome
2026-10-29[UPDATE] [kritisch] GitLab: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29Mattermost security advisory (AV26-1104)CCCS（カナダ）
2026-10-29[UPDATE] [mittel] docker: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[NEU] [niedrig] Octopus Deploy: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Cisco Secure Firewall Threat Defense und Cisco ASA: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[NEU] [kritisch] Grafana: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] HCL BigFix AEX: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Norton Antivirus: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Juniper Session Smart Router: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Jenkins: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [UNGEPATCHT] [hoch] Sophos Unified Threat Management (UTM) Software: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenCERT-Bund（BSI）
2026-10-29[NEU] [niedrig] MLflow: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[NEU] [kritisch] Drupal Erweiterungen: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Red Hat WildFly: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Google Cloud Platform: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Icinga 2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Langflow: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Mitel OpenScape Endpoint Management: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[NEU] [niedrig] systemd: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Apache Camel A2A: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Apache Kafka: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Tailscale: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (xdg-dbus-proxy): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Quay und Enterprise Linux (pypdf, urllib3, URI): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] GNU Emacs: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Internet Systems Consortium BIND: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Podman: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] libxml2: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Apache Ant: Schwachstelle ermöglicht Manipulation von DatenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] libxml2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [niedrig] libxml2: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] libxml2: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Apache CXF: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29n8n security advisory (AV26-1103)CCCS（カナダ）
2026-10-29[UPDATE] [niedrig] expat: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] FasterXML Jackson: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Oracle Java SE: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) und Red Hat Build of Apache Camel for Quarkus: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux Libreswan: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Oracle Java SE and GraalVM, und OpenJDK: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Oracle Java SE: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] gcc: Schwachstelle ermöglicht Manipulation von Dateien und DoSCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Mozilla Firefox und Thunderbird: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Apache CXF: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Mozilla Firefox, Firefox ESR, und Thunderbird: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux ca-certificates: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Vercel Next.js: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] libsndfile: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] LibreOffice: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat OpenShift Container Platform (opentelemetry-go, qs.stringify): Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (mrtg, kbd, urwid): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Intel UEFI Reference BIOS: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Netty: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go-Module (Net, Image, Crypto: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [niedrig] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go "FIPS OpenSSL": Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Google Chrome: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] WP Royal Royal Elementor Addons: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Samba: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifische AngriffeCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] NGINX: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] cURL: Mehre SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] n8n: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] cURL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Heimdal: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Google Chrome: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Lenovo BIOS: Mehrere Schwachstellen ermöglichen PrivilegieneskalationCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (cjose): Schwachstelle ermöglicht Manipulation von DatenCERT-Bund（BSI）
2026-10-29[UPDATE] [UNGEPATCHT] [hoch] Keycloak: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] Node.js: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] poppler: Schwachstelle ermöglicht Denial of Service und Manipulation von DatenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (libsoup): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] expat: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] sudo: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] X.Org X11 und Xwayland: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Ruby: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] LibreOffice: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Node.js: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] expat: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Node.js: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] WebKitGTK: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (cjose): Schwachstelle ermöglicht Denial of Service und Manipulation von DatenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (rhc): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Ruby: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29Cisco security advisory (AV26-1102)CCCS（カナダ）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (flatpak): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Python: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] VMware Produkte: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel (Fragnesia): Schwachstelle ermöglicht Erlangen von AdministratorrechtenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] MLflow: Mehrere Schwachstellen ermöglichen Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (corosync, libevent, libsoup): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] PCRE2 (Perl Compatible Regular Expressions): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] MongoDB: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [niedrig] Red Hat Enterprise Linux (GNU coreutils unexpand): Schwachstelle ermöglicht DoS und Manipulation von DateienCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (python-cryptography): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] FasterXML Jackson: Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] rsyslog: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU libc: Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU libc: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU Emacs TRAMP: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU libc: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] libvirt: Schwachstelle ermöglicht Privilegieneskalation und DoSCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (attr): Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] IBM App Connect Enterprise: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] expat: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (glib2): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (yelp, dracut): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (nodejs:24): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU libc: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (libreswan): Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] rsyslog: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (acl): Mehrere Schwachstellen ermöglichen Privilegieneskalation und Manipulation von DateienCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Oracle Solaris Drittanbieterkomponenten: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat OpenShift Container Platform (fast-uri,OpenTelemetry-Go) : Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (python-pip): Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] OpenSSH: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Dell PowerProtect Data Domain: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Digium Certified Asterisk: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] cURL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] FasterXML Jackson: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Google Cloud Platform (GKE containerd): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (dracut): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] MIT Kerberos: Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] OpenSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] UV: Schwachstelle ermöglicht Manipulation von Dateien und potenziell CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Erlang/OTP: Mehrere Schwachstellen ermöglichen Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Linux Kernel: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] GnuTLS: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Oracle Siebel CRM: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Oracle Java SE: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat OpenShift Container Platform (gRPC-Go): Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] OpenSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] OpenSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Golang Go: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [niedrig] Golang Go: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] GNU Emacs und Red Hat Enterprise Linux: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (pki and Libreswan): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (Libreswan): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Asterisk: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Vaultwarden: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Dell PowerProtect Data Domain OS: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Veeam Backup für Microsoft 365: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] GnuPG: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit BenutzerrechtenCERT-Bund（BSI）
2026-10-29[NEU] [UNGEPATCHT] [mittel] expat: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Veeam ONE: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Veeam Backup & Replication: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] CrushFTP: Schwachstelle ermöglicht Erlangen von AdministratorrechtenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] WatchGuard Fireware OS: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [UNGEPATCHT] [mittel] Grafana: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Tanium Endpoint Management: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Adobe Creative Cloud Desktop Application und Substance 3D Painter: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Asterisk: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Microsoft Edge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] Adobe Connect: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[NEU] [UNGEPATCHT] [mittel] LibreSSL: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] OPNsense: Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit AdministratorrechtenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] NetApp Data ONTAP: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Axis Camera Station: Schwachstelle ermöglicht nicht spezifizierten AngriffCERT-Bund（BSI）
2026-10-29[NEU] [mittel] IBM SPSS Analytic Server: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-29[NEU] [mittel] IBM i: Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] FasterXML Jackson: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29[NEU] [mittel] vllm: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] Acronis Cyber Protect: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] TeamViewer: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] n8n: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [hoch] SolarWinds Platform: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[NEU] [mittel] TeamViewer: Mehrere Schwachstellen ermöglichen PrivilegieneskalationCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] vm2: Mehrere Schwachstellen ermöglichen CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] vm2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] vm2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] vm2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [kritisch] vm2: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Microsoft Entwicklerwerkzeuge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] Red Hat Enterprise Linux (resteasy): Schwachstelle ermöglicht Offenlegung von InformationenCERT-Bund（BSI）
2026-10-29[UPDATE] [mittel] X.Org X11: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-29[UPDATE] [hoch] Red Hat Enterprise Linux (urllib3): Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-29注意喚起: PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (更新)JPCERT/CC
2026-10-29CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks
2026-10-29CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)Palo Alto Networks
2026-10-29JVN: Apache Struts 2 RESTプラグインにおける、@StrutsParameterの制限が@JsonAnySetterに適用されない問題JPCERT/CC
2026-10-29Vulnérabilité dans les produits Cisco (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Vulnérabilité dans les produits NetApp (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans Veeam Backup for Microsoft 365 (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans Elastic Cloud Enterprise (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Vulnérabilité dans les produits Kaspersky (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans PostgreSQL Anonymizer (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans les produits Juniper Networks (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Vulnérabilité dans Mattermost Server (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans WordPress (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans Apache Kafka (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Vulnérabilité dans les produits ESET (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29Multiples vulnérabilités dans Foxit Online Services (29 octobre 2026)CERT-FR（ANSSI）
2026-10-29DSA-6595-1 tor - security updateDebian DSA
2026-10-29DSA-6594-1 python-git - security updateDebian DSA
2026-10-29DSA-6593-1 imagemagick - security updateDebian DSA
2026-10-29DSA-6596-1 wordpress - security updateDebian DSA
2026-10-29Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityCisco PSIRT
2026-10-29Vulnerabilities in Node.js Affecting Cisco Products: October 2026Cisco PSIRT
2026-10-29Early Stable Update for DesktopGoogle Chrome
2026-10-29VMware security advisory (AV26-763) – Update 2CCCS（カナダ）
2026-10-29Stable Channel Update for ChromeOS / ChromeOS FlexGoogle Chrome
2026-10-29Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate AuthoritiesCisco PSIRT
2026-10-29Juniper Networks security advisory (AV26-1101)CCCS（カナダ）
2026-10-29Mozilla security advisory (AV26-1100)CCCS（カナダ）
2026-10-29Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service VulnerabilityCisco PSIRT
2026-10-29Apple security advisory (AV26-1099)CCCS（カナダ）
2026-10-29AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian OrganizationsCCCS（カナダ）
2026-10-29Progress security advisory (AV26-1098)CCCS（カナダ）
2026-10-29Chrome Beta for Desktop UpdateGoogle Chrome
2026-10-29Oracle Corporation security advisory (AV26-1071) – Update 1CCCS（カナダ）
2026-10-29Chrome for Android UpdateGoogle Chrome
2026-10-29Vulnerabilities in PHP Affecting Cisco Products: October 2026Cisco PSIRT
2026-10-29Cisco Advance Notification for Publication of November 4, 2026, Security AdvisoriesCisco PSIRT
2026-10-29Tanium security advisory (AV26-1097)CCCS（カナダ）
2026-10-29Veeam security advisory (AV26-1096)CCCS（カナダ）
2026-10-28Google Chrome security advisory (AV26-1095)CCCS（カナダ）
2026-10-28WatchGuard security advisory (AV26-1094)CCCS（カナダ）
2026-10-28TeamViewer security advisory (AV26-1093)CCCS（カナダ）
2026-10-28Adobe security advisory (AV26-1092)CCCS（カナダ）
2026-10-28Chrome Beta for Android UpdateGoogle Chrome
2026-10-28AL26-027 - Critical vulnerability impacting Google Brotli – CVE-2026-111497CCCS（カナダ）
2026-10-28[UPDATE] [mittel] Nextcloud (Server, Tables, Whiteboard, Files Confidential, Collectives, Richdocuments): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] QT: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] Octopus Deploy: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] Microsoft .NET und ASP.NET: Schwachstelle ermöglicht PrivilegieneskalationCERT-Bund（BSI）
2026-10-28[UPDATE] [niedrig] IBM SPSS Modeler: Schwachstelle ermöglicht Manipulation von DateienCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] HAProxy: Mehrere Schwachstellen ermöglichen Denial of ServiceCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] GitLab: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] PowerDNS Recursor: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] MongoDB: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] PostgreSQL psqlODBC Treiber: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] Red Hat Enterprise Linux (rpcbind): Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] Xen: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] Red Hat Enterprise Linux (goose, environment-modules, tornado): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] MLflow: Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] MongoDB Treiber: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] CPython: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] Red Hat Enterprise Linux (libpcap): Schwachstelle ermöglicht Offenlegung von Informationen und CodeausführungCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] Red Hat Enterprise Linux (gawk): Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] FasterXML Jackson Databind: Schwachstelle ermöglicht Denial of ServiceCERT-Bund（BSI）
2026-10-28[UPDATE] [mittel] PCRE (Perl Compatible Regular Expressions): Schwachstelle ermöglicht CodeausführungCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] GitLab: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28[UPDATE] [hoch] Google Chrome / Microsoft Edge: Mehrere SchwachstellenCERT-Bund（BSI）
2026-10-28JVN: PHPにおける複数の任意のコードが実行可能な脆弱性（CVE-2026-109618、CVE-2026-109619）JPCERT/CC
2026-10-28JVN: ヤマハ製NWR100における複数の脆弱性JPCERT/CC
2026-10-28JVN: Yamaha LAN Monitor for WindowsのインストーラにおけるDLL読み込みに関する脆弱性JPCERT/CC
2026-10-28JVN: ヤマハ製YMS-VPN8およびYMS-VPN8-CPにおける引用符で囲まれていないファイルパスの脆弱性JPCERT/CC
2026-10-28Weekly Report: VeloCloud OrchestratorにSQLインジェクションの脆弱性JPCERT/CC
2026-10-28Weekly Report: ISC BINDに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: 複数のCisco製品に脆弱性JPCERT/CC
2026-10-28Weekly Report: GitLabに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: Apache Tomcatに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: Google Chromeに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: 複数のAtlassian製品に脆弱性JPCERT/CC
2026-10-28Weekly Report: 複数のMozilla製品に脆弱性JPCERT/CC
2026-10-28Weekly Report: LaravelのTokenGuardに認証回避につながる脆弱性JPCERT/CC
2026-10-28Weekly Report: Roundcube Webmailに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: MOVEit Transferに複数の脆弱性JPCERT/CC
2026-10-28Weekly Report: 複数のOracle製品に脆弱性JPCERT/CC
2026-10-28Weekly Report: PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起JPCERT/CC
2026-10-28Weekly Report: JPCERT/CCが2026年7月から2026年9月分の「ソフトウェア等の脆弱性関連情報に関する届出状況」を公開JPCERT/CC
2026-10-28Weekly Report: JPCERT/CCが2026年7月から9月分の「JPCERT/CC 四半期レポート」を公開JPCERT/CC
2026-10-28JVN: CISA ICS Advisory / ICS Medical Advisory（2026年10月27日）JPCERT/CC
2026-10-28Multiples vulnérabilités dans Metabase (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans les produits Veeam (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans Palo Alto Networks PAN-OS (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Vulnérabilité dans CPython (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans Google Chrome (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans Mitel OpenScape Endpoint Management (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Vulnérabilité dans les produits Belden (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Vulnérabilité dans Axis Camera Station Pro (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans Docker Desktop (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans Microsoft Edge (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Vulnérabilité dans Samba (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28Multiples vulnérabilités dans les produits Mozilla (28 octobre 2026)CERT-FR（ANSSI）
2026-10-28DSA-6592-1 chromium - security updateDebian DSA
2026-10-28DSA-6591-1 openjdk-25 - security updateDebian DSA
2026-10-28DSA-6590-1 firefox-esr - security updateDebian DSA
2026-10-28USN-8956-2: Brotli vulnerabilityUbuntu USN
2026-10-28Adobe security advisory (AV26-697) – Update 1CCCS（カナダ）
2026-10-28Chrome for Android UpdateGoogle Chrome
2026-10-28Google security advisory (AV26-1085) - Update 1CCCS（カナダ）
2026-10-28Stable Channel Update for DesktopGoogle Chrome
2026-10-28Beta Channel Update for ChromeOS / ChromeOS FlexGoogle Chrome
2026-10-28Chrome Stable for iOS UpdateGoogle Chrome
2026-10-28AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619 - Update 2CCCS（カナダ）
2026-10-28USN-8957-1: authd vulnerabilityUbuntu USN
2026-10-28[Control systems] Hitachi security advisory (AV26-1091)CCCS（カナダ）

Sources

CCCS（カナダ）
CERT-Bund（BSI）
CERT-EU
CERT-FR（ANSSI）
CISA KEV（悪用確認）
Cisco PSIRT
Debian DSA
Fortinet PSIRT
GitHub Advisory（actions）
GitHub Advisory（composer）
GitHub Advisory（go）
GitHub Advisory（maven）
GitHub Advisory（npm・pip）
GitHub Advisory（npm・rust）
GitHub Advisory（npm）
GitHub Advisory（pip）
GitHub Advisory（rubygems）
GitHub Advisory（rust）
Google Chrome
IPA
JPCERT/CC
NCSC（英国）
NVD（米国 NIST）
Node.js
Oracle
Palo Alto Networks
Python（PSF）
Ubuntu USN

Ranking is rule-based (KEV, CVSS) and may miss or misjudge items. Always confirm with the primary source.