Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 419new in the last 7 days
- 8added as actively exploited
- 37critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-116245 | High CVSS 7.1 |
- Operating systems & software |
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an… | 30 Oct 2026 |
| CVE-2026-116244 | High CVSS 7.1 |
- Identity & access |
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME… | 30 Oct 2026 |
| CVE-2026-116243 | High CVSS 7.7 |
- Operating systems & software |
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In… | 30 Oct 2026 |
| CVE-2026-116242 | High CVSS 7.1 |
- Identity & access |
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,… | 30 Oct 2026 |
| CVE-2026-116241 | Critical CVSS 9.4 |
- Operating systems & software |
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the… | 30 Oct 2026 |
| CVE-2026-116240 | High CVSS 7.1 |
- Operating systems & software |
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which… | 30 Oct 2026 |
| CVE-2026-116239 | High CVSS 8.9 |
- Identity & access |
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example,… | 30 Oct 2026 |
| CVE-2026-116238 | Critical CVSS 9.2 |
- Identity & access |
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit… | 30 Oct 2026 |
| CVE-2026-115830 | High CVSS 8.7 |
- Cloud & SaaS |
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and… | 30 Oct 2026 |
| CVE-2026-115829 | High CVSS 8.7 |
- Operating systems & software |
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by… | 30 Oct 2026 |
| CVE-2026-115828 | Medium CVSS 5.1 |
- Operating systems & software |
In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when… | 30 Oct 2026 |
| CVE-2026-118527 Exploited |
Not yet scored | Ivanti Connect Secure Network & security devices |
Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | 30 Oct 2026 |
| CVE-2026-111357 Exploited |
Not yet scored | Ivanti Connect Secure Network & security devices |
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | 30 Oct 2026 |
| CVE-2026-97229 Exploited |
Not yet scored | GitLab Community Edition and Enterprise Edition Operating systems & software |
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability | 29 Oct 2026 |
| CVE-2026-76418 Exploited |
Not yet scored | Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Network & security devices |
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability | 29 Oct 2026 |
| CVE-2026-41709 Exploited |
Not yet scored | Broadcom VMware ESX Operating systems & software |
Broadcom VMWare ESX Insufficient Logging Vulnerability | 28 Oct 2026 |
| CVE-2026-46300 Exploited |
Not yet scored | Linux Kernel Applications & supply chain |
Linux Kernel Missing Initialization of a Variable Vulnerability | 28 Oct 2026 |
| CVE-2026-111497 Exploited |
Not yet scored | Google Brotli Operating systems & software |
Google Brotli Unchecked Return Value Vulnerability | 27 Oct 2026 |
| CVE-2026-48356 Exploited |
Not yet scored | Adobe Commerce and Magento Operating systems & software |
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability | 27 Oct 2026 |
| CVE-2026-109618 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Memory Corruption Vulnerability | 26 Oct 2026 |
| CVE-2026-109619 Exploited |
Not yet scored | PHP Group PHP Applications & supply chain |
PHP Stale Internal Request-State Vulnerability | 26 Oct 2026 |
| CVE-2026-114625 Exploited |
Not yet scored | Arista VeloCloud Orchestrator Applications & supply chain |
Arista VeloCloud Orchestrator SQL Injection Vulnerability | 23 Oct 2026 |
| CVE-2026-110447 Exploited |
Not yet scored | Collabora Collabora Online – Built-in CODE Server Operating systems & software |
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability | 23 Oct 2026 |
| CVE-2026-96652 Exploited |
Not yet scored | Plex Media Server Operating systems & software |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 20 Oct 2026 |
| CVE-2026-96655 Exploited |
Not yet scored | Plex Media Server Operating systems & software |
Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability | 20 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.