Sources:
amazon_linux
archlinux
azure_linux
bitnami_vulndb
capec
capec_enrichment_dashboard
certeu
certfr
circl_kev
cisa_known_exploited
cna_scorecard
cnvd
csaf_abb
csaf_adstecindustrialitgmbh
csaf_amd
csaf_aumariestergmbhcokg
csaf_baadem2mproductsgmbh
csaf_beckhoffautomationgmbhcokg
csaf_bendergmbhcokg
csaf_bosch
csaf_bsi
csaf_bsi_aggregator
csaf_bsi_cvd_white
csaf_bsi_white
csaf_bsi_wid_white
csaf_carlogavazziautomation
csaf_certbund
csaf_certvde
csaf_cisa
csaf_cisa_it
csaf_cisa_ot
csaf_cisco
csaf_claaskgaa
csaf_codesysgmbh
csaf_dell
csaf_duraggmbh
csaf_endresshauserag
csaf_ericsson
csaf_euchnergmbhcokg
csaf_festosecokg
csaf_frauschersensortechnikgmbh
csaf_hancom
csaf_harmaninternational
csaf_helmholzgmbhcokg
csaf_himapaulhildebrandtgmbh
csaf_hitachi
csaf_hpe
csaf_huawei
csaf_hydacinternationalgmbh
csaf_ibm
csaf_ifmelectronicgmbh
csaf_janitzaelectronicsgmbh
csaf_jumogmbhcokg
csaf_juniper
csaf_kebautomationkg
csaf_kukaag
csaf_lenovo
csaf_lenzese
csaf_mbconnectlinegmbh
csaf_mettlertoledogmbh
csaf_metzconnectgmbh
csaf_microsoft
csaf_mieleciekg
csaf_moxa
csaf_murrelektronikgmbh
csaf_ncscnl
csaf_ndaal
csaf_netapp
csaf_nozomi
csaf_nozominetworks
csaf_nvidia
csaf_opcfoundation
csaf_openeuler
csaf_opensuse
csaf_oracle
csaf_ox
csaf_paloalto
csaf_panasonic
csaf_pentagrid
csaf_pepperlfuchsse
csaf_phoenix
csaf_pilzgmbhcokg
csaf_qnap
csaf_redhat
csaf_samsung
csaf_sauterag
csaf_schneider
csaf_sick
csaf_siemens
csaf_smasolartechnologyag
csaf_suse
csaf_swarcotrafficsystemsgmbh
csaf_synology
csaf_tibco
csaf_trend
csaf_trumpfsecokg
csaf_trustsource
csaf_tuxcare
csaf_ubiquiti
csaf_vartastoragegmbh
csaf_vegagrieshaberkg
csaf_vmware
csaf_wagogmbhcokg
csaf_weidmuellerinterfacegmbhcokg
csaf_welotecgmbh
csaf_wiesemanntheisgmbh
csaf_yaskawaeuropegmbh
csaf_yokogawa
csaf_zyxel
cve_forecast
cve_icu
cve_vs_github_dashboard
cvelistv5
cwe_dashboard
cwe_enrichment
cwec
debian_rustsec
debian_security_tracker
drupal
emb3d
emb3d_dashboard
epss_dashboard
epss_history
epss_kev_enrichment
euvd_kev
fedora
fkie_nvd
freebsd
gcve
gcve_enriched
gcve_enrichment
gcve_enrichment_dashboard
gentoo
github
gsd
jvn
kev_ransomware
mitre_attack
moksha
ndaal_kev
netbsd
nuclei_dashboard
nuclei_enrichment
nvd
nvd_cpe_dictionary
openbsd
opencve
oracle_linux
ossf_malicious_packages
osv_almalinux
osv_alpine
osv_android
osv_bellsoft
osv_chainguard
osv_cran
osv_github_actions
osv_golang
osv_haskell
osv_hex
osv_linux
osv_maven
osv_npm
osv_nuget
osv_ocaml
osv_ossfuzz
osv_packagist
osv_pub
osv_rocky
osv_rubygems
osv_rustsec
osv_swift
osv_ubuntu
osv_wolfi
publish_stats
pysec
sadp_pilot
ssvc
ssvc_dashboard
tailscale
tsunami_enrichment
variot
vulncheck_kev
vulnrichment
Clear
| ID | Title | Severity | CVSS | Source | Updated |
|---|---|---|---|---|---|
| cve-2026-39747 | WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability | HIGH | 8.5 | cvelistv5 | 2026-11-05 |
| cve-2026-123119 | Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342) | LOW | 2.3 | cvelistv5 | 2026-11-05 |
| cve-2026-123020 | eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine | MEDIUM | 5.3 | cvelistv5 | 2026-11-05 |
| cve-2026-103866 | Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling | UNKNOWN | cvelistv5 | 2026-11-05 | |
| cve-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | UNKNOWN | cvelistv5 | 2026-11-05 | |
| cve-2026-103863 | Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths | UNKNOWN | cvelistv5 | 2026-11-05 | |
| cve-2026-95652 | Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter | MEDIUM | 6.6 | cvelistv5 | 2026-11-05 |
| cve-2026-123047 | Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts | HIGH | 7.5 | cvelistv5 | 2026-11-05 |
| cve-2026-123019 | eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere | MEDIUM | 6.9 | cvelistv5 | 2026-11-05 |
| cve-2026-121489 | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-96677 | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73117 | Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73116 | Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73101 | Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73100 | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73099 | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73098 | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing | CRITICAL | 10.0 | cvelistv5 | 2026-11-05 |
| cve-2026-73095 | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling | HIGH | 8.7 | cvelistv5 | 2026-11-05 |
| cve-2026-123018 | eosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection | MEDIUM | 6.9 | cvelistv5 | 2026-11-05 |
| cve-2026-123036 | A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored. | MEDIUM | 5.5 | cvelistv5 | 2026-11-05 |
| cve-2026-118869 | An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary OS commands on the system running the product. | HIGH | 8.7 | cvelistv5 | 2026-11-05 |
| cve-2026-117679 | A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute arbitrary script in a user's web browser when the user accesses a website using the affected product. | MEDIUM | 5.1 | cvelistv5 | 2026-11-05 |
| cve-2026-73996 | cve-2026-73996 | CRITICAL | 9.8 | cvelistv5 | unknown |
| cve-2026-112072 | vault-java-driver: stored deeply nested JSON kills every thread that reads it | MEDIUM | 6.5 | cvelistv5 | 2026-11-05 |
| cve-2026-62041 | WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability | MEDIUM | 5.4 | cvelistv5 | 2026-11-05 |
| cve-2026-109408 | vault-java-driver: SslConfig silently disables requested TLS verification | HIGH | 7.4 | cvelistv5 | 2026-11-05 |
| cve-2026-107776 | Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coupon | LOW | 2.2 | cvelistv5 | 2026-11-05 |
| cve-2026-100109 | Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user | CRITICAL | 9.8 | cvelistv5 | 2026-11-05 |
| cve-2026-123033 | cve-2026-123033 | HIGH | 8.3 | cvelistv5 | unknown |
| cve-2026-123029 | cve-2026-123029 | HIGH | 7.5 | cvelistv5 | unknown |