Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
| ID | CVSS | Description | Vendor | Product | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-108901 |
5.1 (4.0)
3.5 (3.1)
3.5 (3.0)
|
Shenzhen HCC Technology MPOS M6 PLUS Display QR Code R… |
Shenzhen HCC Technology |
MPOS M6 PLUS |
2026-10-12T15:45:06.567Z | 2026-10-12T15:45:06.567Z |
| CVE-2026-103060 |
7.5 (4.0)
|
Path traversal in rebar3 via unvalidated dependency ap… |
erlang |
rebar3 |
2026-10-12T15:43:57.636Z | 2026-10-12T15:43:57.636Z |
| CVE-2026-85950 |
8.4 (3.1)
|
Improper privilege management in Progress MarkLogic Se… |
Progress Software Corporation |
MarkLogic Server |
2026-10-12T15:42:22.190Z | 2026-10-12T15:42:22.190Z |
| CVE-2026-96612 |
7.5 (4.0)
|
Path traversal in Hex via unvalidated dependency app names |
hexpm |
hex |
2026-10-12T15:39:49.862Z | 2026-10-12T15:39:49.862Z |
| CVE-2026-85949 |
8.1 (3.1)
|
Sensitive information exposure in Progress MarkLogic S… |
Progress Software Corporation |
MarkLogic Server |
2026-10-12T15:36:31.613Z | 2026-10-12T15:36:31.613Z |
| CVE-2026-85948 |
9.9 (3.1)
|
Improper privilege management in Progress MarkLogic Se… |
Progress Software Corporation |
MarkLogic Server |
2026-10-12T15:35:05.124Z | 2026-10-12T15:35:05.124Z |
| CVE-2026-85947 |
9.9 (3.1)
|
Improper privilege management in Progress MarkLogic Se… |
Progress Software Corporation |
MarkLogic Server |
2026-10-12T15:34:01.239Z | 2026-10-12T15:34:01.239Z |
| CVE-2026-9191 |
9.6 (3.1)
|
Insufficient isolation of user-supplied code in Progre… |
Progress Software Corporation |
MarkLogic Server |
2026-10-12T15:32:46.475Z | 2026-10-12T15:32:46.475Z |
| CVE-2026-105668 |
7.1 (4.0)
|
Hex release-age cooldown is lifted package-wide when t… |
hexpm |
hex |
2026-10-12T15:31:58.926Z | 2026-10-12T15:31:58.926Z |
| CVE-2026-108900 |
6.9 (4.0)
7.3 (3.1)
7.3 (3.0)
|
Exponent CMS XML-RPC xmlrpc.php userLogin sql injection |
Exponent |
CMS |
2026-10-12T15:30:19.217Z | 2026-10-12T15:30:19.217Z |
| CVE-2026-105280 |
6.9 (4.0)
|
Hex writes unverified package tarballs to standard out… |
hexpm |
hex |
2026-10-12T15:30:14.126Z | 2026-10-12T15:30:14.126Z |
| CVE-2026-96618 |
2.1 (4.0)
|
Hex exhausts memory and disk on oversized or compresse… |
hexpm |
hex |
2026-10-12T15:29:19.117Z | 2026-10-12T15:29:19.117Z |
| CVE-2026-109195 |
3.1 (3.1)
|
Quay: repository auto-prune policy uuid idor in quay api |
Red Hat |
Red Hat Quay 3 |
2026-10-12T15:27:03.366Z | 2026-10-12T15:27:03.366Z |
| CVE-2026-109194 |
6.4 (3.1)
|
Quay: build trigger uuid idor in quay api |
Red Hat |
Red Hat Quay 3 |
2026-10-12T15:27:03.175Z | 2026-10-12T15:27:03.175Z |
| CVE-2026-103503 |
5.9 (4.0)
|
Hex trusts its bundled CA certificates when cacerts_pa… |
hexpm |
hex |
2026-10-12T15:17:45.545Z | 2026-10-12T15:17:45.545Z |
| CVE-2026-109399 |
9.2 (4.0)
8.1 (3.1)
|
SWUpdate through 2026.05.1 CMS Signature Verification … |
sbabic |
swupdate |
2026-10-12T15:16:44.440Z | 2026-10-12T15:16:44.440Z |
| CVE-2026-109398 |
8.7 (4.0)
7.5 (3.1)
|
Gumlet php-image-resize before 3.0.1 Denial of Service… |
gumlet |
php-image-resize |
2026-10-12T15:16:43.793Z | 2026-10-12T15:16:43.793Z |
| CVE-2026-109397 |
8.6 (4.0)
7.2 (3.1)
|
Thelia before 3.1.2 and 3.2.x before 3.2.1 File Upload… |
Thelia |
Thelia |
2026-10-12T15:16:43.107Z | 2026-10-12T15:16:43.107Z |
| CVE-2026-109396 |
2.3 (4.0)
4.2 (3.1)
|
Thelia before 3.1.2 and 3.2.x before 3.2.1 CSV Formula… |
Thelia |
Thelia |
2026-10-12T15:16:41.909Z | 2026-10-12T15:16:41.909Z |
| CVE-2026-109394 |
9.1 (4.0)
7.4 (3.1)
|
Thirty bees through 1.7.0 Account Takeover via Passwor… |
thirty bees |
thirty bees |
2026-10-12T15:16:41.257Z | 2026-10-12T15:16:41.257Z |
| CVE-2026-109393 |
5.3 (4.0)
6.3 (3.1)
|
QloApps through 1.7.0 Insecure Direct Object Reference… |
Webkul |
QloApps |
2026-10-12T15:16:40.590Z | 2026-10-12T15:16:40.590Z |
| CVE-2026-109392 |
5.1 (4.0)
5.4 (3.1)
|
Pimcore through 2026.3.1 Stored XSS via ExternalImage … |
Pimcore |
Pimcore |
2026-10-12T15:16:39.934Z | 2026-10-12T15:16:39.934Z |
| CVE-2026-109391 |
9.2 (4.0)
8.1 (3.1)
|
Square Squash through commit e73f280 Unauthenticated Y… |
Square |
Squash |
2026-10-12T15:16:39.257Z | 2026-10-12T15:16:39.257Z |
| CVE-2026-72708 |
8.7 (4.0)
7.5 (3.1)
|
SPIP < 4.4.18 Unauthenticated Blind SQL Injection via … |
SPIP |
SPIP |
2026-09-11T16:37:06.961Z | 2026-10-12T15:15:48.098Z |
| CVE-2026-108899 |
6.9 (4.0)
7.3 (3.1)
7.3 (3.0)
|
tobychui zoraxy Path Exception Matcher authProviders.g… |
tobychui |
zoraxy |
2026-10-12T15:15:12.313Z | 2026-10-12T15:15:12.313Z |
| CVE-2026-92681 |
9.3 (4.0)
|
@neo4j/graphql: schema-level and type-level @authentic… |
Neo4j |
@neo4j/graphql |
2026-10-12T15:09:49.653Z | 2026-10-12T15:09:49.653Z |
| CVE-2026-92682 |
8.6 (4.0)
|
@neo4j/graphql: authorization relationship and connect… |
Neo4j |
@neo4j/graphql |
2026-10-12T15:07:44.638Z | 2026-10-12T15:07:44.638Z |
| CVE-2026-107248 |
N/A
|
CVE-2026-107248 |
Thelia |
Thelia |
2026-10-12T15:06:55.302Z | 2026-10-12T15:06:55.302Z |
| CVE-2026-109390 |
9.8 (3.1)
|
AnyDesk before 8.0.3 allows unauthenticated remot… |
AnyDesk |
AnyDesk |
2026-10-12T14:40:10.223Z | 2026-10-12T15:02:33.284Z |
| CVE-2026-103521 |
7.2 (3.1)
|
CVE-2026-103521 |
Thelia |
Thelia |
2026-10-12T14:52:56.850Z | 2026-10-12T15:00:39.229Z |