Vulnerabilities
Latest CVEs across software, hardware, network and cloud
New vulnerabilities from the U.S. National Vulnerability Database, with CISA's Known Exploited list flagged so you can see what attackers are using now.
- 311new in the last 7 days
- 10added as actively exploited
- 30critical (CVSS 9+)
Technology
- All
- Operating systems & software
- Network & security devices
- Cloud & SaaS
- Hardware & firmware
- Identity & access
- OT, ICS & IoT
- Applications & supply chain
Severity
| CVE | Severity | Affected | Summary | Published |
|---|---|---|---|---|
| CVE-2026-120195 | Critical CVSS 9.3 |
- Operating systems & software |
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the… | 1 Nov 2026 |
| CVE-2026-120192 | Medium CVSS 5.5 |
- Operating systems & software |
A security vulnerability has been detected in Presenton up to 0.9.11-beta. This affects an unknown part of the file… | 1 Nov 2026 |
| CVE-2026-120252 | Medium CVSS 6.8 |
- Operating systems & software |
imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG… | 1 Nov 2026 |
| CVE-2026-120250 | Medium CVSS 6.0 |
- Operating systems & software |
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and… | 1 Nov 2026 |
| CVE-2026-120249 | Medium CVSS 6.9 |
- Operating systems & software |
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the… | 1 Nov 2026 |
| CVE-2026-120248 | Medium CVSS 4.6 |
- Operating systems & software |
Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office… | 1 Nov 2026 |
| CVE-2026-120247 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows… | 1 Nov 2026 |
| CVE-2026-120246 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack… | 1 Nov 2026 |
| CVE-2026-120245 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks… | 1 Nov 2026 |
| CVE-2026-120244 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows… | 1 Nov 2026 |
| CVE-2026-120243 | Medium CVSS 6.8 |
- Operating systems & software |
FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows… | 1 Nov 2026 |
| CVE-2026-120190 | Low CVSS 2.0 |
- Operating systems & software |
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown… | 1 Nov 2026 |
| CVE-2026-120189 | Critical CVSS 9.3 |
- Operating systems & software |
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of… | 1 Nov 2026 |
| CVE-2026-118636 | Critical CVSS 9.8 |
- Operating systems & software |
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls… | 31 Oct 2026 |
| CVE-2026-118147 | High CVSS 7.4 |
- Operating systems & software |
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network. | 31 Oct 2026 |
| CVE-2026-120209 | Critical CVSS 9.3 |
- Operating systems & software |
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid… | 31 Oct 2026 |
| CVE-2026-120208 | High CVSS 7.7 |
- Operating systems & software |
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in… | 31 Oct 2026 |
| CVE-2026-120207 | High CVSS 7.0 |
- Operating systems & software |
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to… | 31 Oct 2026 |
| CVE-2026-120206 | Medium CVSS 5.9 |
- Operating systems & software |
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to… | 31 Oct 2026 |
| CVE-2026-120205 | High CVSS 7.4 |
- Operating systems & software |
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows… | 31 Oct 2026 |
| CVE-2026-120204 | Medium CVSS 6.3 |
- Operating systems & software |
DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows… | 31 Oct 2026 |
| CVE-2026-120202 | High CVSS 7.1 |
- Operating systems & software |
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide… | 31 Oct 2026 |
| CVE-2026-120201 | Critical CVSS 9.3 |
- Operating systems & software |
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to… | 31 Oct 2026 |
| CVE-2026-120200 | Medium CVSS 5.3 |
- Operating systems & software |
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to… | 31 Oct 2026 |
| CVE-2026-78192 | Not yet scored | - Operating systems & software |
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the… | 31 Oct 2026 |
Data comes from the NVD and CISA's Known Exploited Vulnerabilities catalogue, collected automatically. Scores and categories may change as analysis completes. This product uses NVD data but is not endorsed or certified by the NVD. Always check the vendor's own notice.