Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-120237 | Low CVSS 2.1 |
- Applications & supply chain |
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired… | 1 Nov 2026 |
| CVE-2026-66570 | High CVSS 7.1 |
- Applications & supply chain |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss… | 1 Nov 2026 |
| CVE-2026-62048 | Critical CVSS 9.3 |
- Applications & supply chain |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web /… | 1 Nov 2026 |
| CVE-2026-120338 | Critical CVSS 10.0 |
- Applications & supply chain |
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a… | 1 Nov 2026 |
| CVE-2026-120235 | Low CVSS 2.1 |
- Applications & supply chain |
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function… | 1 Nov 2026 |
| CVE-2026-120233 | Medium CVSS 5.5 |
- Applications & supply chain |
A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file… | 1 Nov 2026 |
| CVE-2026-120232 | High CVSS 8.5 |
- Applications & supply chain |
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the… | 1 Nov 2026 |
| CVE-2026-120224 | High CVSS 8.6 |
- Applications & supply chain |
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function… | 1 Nov 2026 |
| CVE-2026-119627 | Not yet scored | - Applications & supply chain |
The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see… | 1 Nov 2026 |
| CVE-2026-119441 | Not yet scored | - Applications & supply chain |
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only… | 1 Nov 2026 |
| CVE-2026-118504 | Not yet scored | - Applications & supply chain |
The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST… | 1 Nov 2026 |
| CVE-2026-118395 | Not yet scored | - Applications & supply chain |
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories… | 1 Nov 2026 |
| CVE-2026-117649 | Not yet scored | - Applications & supply chain |
The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot… | 1 Nov 2026 |
| CVE-2026-117646 | Not yet scored | - Applications & supply chain |
The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included… | 1 Nov 2026 |
| CVE-2026-117635 | Not yet scored | - Applications & supply chain |
The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only… | 1 Nov 2026 |
| CVE-2026-116474 | Not yet scored | - Applications & supply chain |
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user`… | 1 Nov 2026 |
| CVE-2026-116296 | Not yet scored | - Applications & supply chain |
The API routes for releases, release assets, milestones and repository labels did not reject changes to archived… | 1 Nov 2026 |
| CVE-2026-114199 | Not yet scored | - Applications & supply chain |
`GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner… | 1 Nov 2026 |
| CVE-2026-112887 | Not yet scored | - Applications & supply chain |
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,… | 1 Nov 2026 |
| CVE-2026-120218 | Low CVSS 2.0 |
- Applications & supply chain |
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of… | 1 Nov 2026 |
| CVE-2026-118168 | Medium CVSS 5.3 |
- Applications & supply chain |
The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler… | 1 Nov 2026 |
| CVE-2026-113482 | Medium CVSS 6.8 |
- Applications & supply chain |
The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before… | 1 Nov 2026 |
| CVE-2026-113481 | Medium CVSS 4.3 |
- Applications & supply chain |
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a… | 1 Nov 2026 |
| CVE-2026-107343 | Medium CVSS 4.3 |
- Applications & supply chain |
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability… | 1 Nov 2026 |
| CVE-2026-107342 | Medium CVSS 4.3 |
- Applications & supply chain |
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability… | 1 Nov 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.