Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-112887 | Not yet scored | - Applications & supply chain |
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,… | 1 Nov 2026 |
| CVE-2026-120218 | Low CVSS 2.0 |
- Applications & supply chain |
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of… | 1 Nov 2026 |
| CVE-2026-120217 | Low CVSS 2.1 |
- Operating systems & software |
A vulnerability was detected in Delgan loguru 0.7.3. The affected element is the function AnsiParser.feed of the file… | 1 Nov 2026 |
| CVE-2026-120198 | Critical CVSS 9.3 |
- Operating systems & software |
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the… | 1 Nov 2026 |
| CVE-2026-118168 | Medium CVSS 5.3 |
- Applications & supply chain |
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler… | 1 Nov 2026 |
| CVE-2026-113482 | Medium CVSS 6.8 |
- Applications & supply chain |
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before… | 1 Nov 2026 |
| CVE-2026-113481 | Medium CVSS 4.3 |
- Applications & supply chain |
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a… | 1 Nov 2026 |
| CVE-2026-107343 | Medium CVSS 4.3 |
- Applications & supply chain |
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability… | 1 Nov 2026 |
| CVE-2026-107342 | Medium CVSS 4.3 |
- Applications & supply chain |
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability… | 1 Nov 2026 |
| CVE-2026-120197 | High CVSS 8.6 |
- Operating systems & software |
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file… | 1 Nov 2026 |
| CVE-2026-120196 | High CVSS 8.6 |
- Operating systems & software |
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file… | 1 Nov 2026 |
| CVE-2026-120195 | Critical CVSS 9.3 |
- Operating systems & software |
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the… | 1 Nov 2026 |
| CVE-2026-120192 | Medium CVSS 5.5 |
- Operating systems & software |
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file… | 1 Nov 2026 |
| CVE-2026-120252 | Medium CVSS 6.8 |
- Operating systems & software |
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG… | 1 Nov 2026 |
| CVE-2026-120251 | Medium CVSS 6.8 |
- Hardware & firmware |
imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that… | 1 Nov 2026 |
| CVE-2026-120250 | Medium CVSS 6.0 |
- Operating systems & software |
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and… | 1 Nov 2026 |
| CVE-2026-120249 | Medium CVSS 6.9 |
- Operating systems & software |
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the… | 1 Nov 2026 |
| CVE-2026-120248 | Medium CVSS 4.6 |
- Operating systems & software |
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office… | 1 Nov 2026 |
| CVE-2026-120247 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows… | 1 Nov 2026 |
| CVE-2026-120246 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack… | 1 Nov 2026 |
| CVE-2026-120245 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks… | 1 Nov 2026 |
| CVE-2026-120244 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows… | 1 Nov 2026 |
| CVE-2026-120243 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows… | 1 Nov 2026 |
| CVE-2026-120191 | Medium CVSS 5.5 |
- Applications & supply chain |
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of… | 1 Nov 2026 |
| CVE-2026-120190 | Low CVSS 2.0 |
- Operating systems & software |
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown… | 1 Nov 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.