| CVE-2025-60496 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-60494 | A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file. | medium | 2026-10-26 |
| CVE-2025-60493 | A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-60491 | A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-60490 | A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-60489 | A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-60487 | A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. | medium | 2026-10-26 |
| CVE-2025-60482 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | medium | 2026-10-26 |
| CVE-2025-60479 | A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file. | medium | 2026-10-26 |
| CVE-2025-60478 | A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file. | medium | 2026-10-26 |
| CVE-2025-60477 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. | medium | 2026-10-26 |
| CVE-2025-60476 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | medium | 2026-10-26 |
| CVE-2025-60475 | A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. | medium | 2026-10-26 |
| CVE-2025-60469 | A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | medium | 2026-10-26 |
| CVE-2025-58403 | CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code, which is executed in the victim's browser when the URL is visited, allowing the attacker to steal session cookies and perform actions on behalf of the victim within the application. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable. | medium | 2026-10-26 |
| CVE-2025-57282 | ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection. | high | 2026-10-26 |
| CVE-2025-57231 | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url. | high | 2026-10-26 |
| CVE-2025-56798 | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy. | high | 2026-10-26 |
| CVE-2025-55787 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. | critical | 2026-10-26 |
| CVE-2025-55640 | A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | medium | 2026-10-26 |
| CVE-2025-55076 | A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system(), which may allow a local user to execute arbitrary commands with root privileges. | medium | 2026-10-26 |
| CVE-2025-53966 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211 vendor command leads to a buffer overflow during handling of an IOCTL message. | high | 2026-10-26 |
| CVE-2025-52097 | Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding | medium | 2026-10-26 |
| CVE-2025-51735 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | high | 2026-10-26 |
| CVE-2025-51734 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. | medium | 2026-10-26 |
| CVE-2025-51679 | An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected behavior. | critical | 2026-10-26 |
| CVE-2025-51511 | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads. | high | 2026-10-26 |
| CVE-2025-50526 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via the switch_status function. | critical | 2026-10-26 |
| CVE-2025-46175 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java. | high | 2026-10-26 |
| CVE-2025-45493 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function. | medium | 2026-10-26 |
| CVE-2025-29419 | CTFd v3.7.6 was discovered to be vulnerable to a man-in-the-middle attack. | high | 2026-10-26 |
| CVE-2025-29338 | NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the mod_para parameter in the woal_init_module_param function. | medium | 2026-10-26 |
| CVE-2025-29229 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. | critical | 2026-10-26 |
| CVE-2025-28344 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function AuxJack. | high | 2026-10-26 |
| CVE-2025-28343 | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function ThreadReadButtons. | high | 2026-10-26 |
| CVE-2025-2708 | A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/upload of the component Backend File Upload Interface. Such manipulation of the argument path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The name of the patch is 4ae3f6b2c9883978837638c14e3d18419819eeb0. Applying a patch is advised to resolve this issue. | medium | 2026-10-26 |
| CVE-2025-2707 | A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload of the component Front-End Store Interface. This manipulation of the argument path causes path traversal. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 4ae3f6b2c9883978837638c14e3d18419819eeb0. It is recommended to apply a patch to fix this issue. | medium | 2026-10-26 |
| CVE-2025-15705 | The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary. | low | 2026-10-26 |
| CVE-2024-3220 | There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations. | low | 2026-10-26 |
| CVE-2024-0443 | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. This issue may allow an attacker with a local access to cause system instability, such as an out of memory error. | medium | 2026-10-26 |
| CVE-2023-7356 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID Copy the content of a Periodic Advertisement Report to BASE only if the service UUID is Basic Audio Announcement Service UUID. | high | 2026-10-26 |
| CVE-2021-48012 | fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass. | high | 2026-10-26 |
| CVE-2020-37282 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges. | critical | 2026-10-26 |
| CVE-2020-37268 | Print Assumptions does not report that a definition was produced while universe checking was disabled when that definition reaches the caller through Parameter Inline in a module type. Applying a functor inlines the body of the parameter, and the inlining drops the record that the term was built under Unset Universe Checking, so the resulting constant carries no trace of the unsafe operation. A module implementation can therefore prove False using a universe inconsistency, expose it through an inlined parameter, and have Print Assumptions report the dependent proof as closed under the global context. Because Print Assumptions is the in-process audit used to confirm that a development rests on no unexpected assumptions, a dependency built this way passes that audit while proving arbitrary propositions. The standalone checker coqchk does reject the resulting compiled file. The project records this in dev/doc/critical-bugs.md under non-fixed bugs and rates the risk as moderate when coqchk is not used. | medium | 2026-10-26 |
| CVE-2014-125135 | A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handler. Such manipulation leads to use of hard-coded cryptographic key . The attack may be performed from remote. Upgrading to version 1.11.1 is able to address this issue. The name of the patch is b4699825d6ab92d5451e5b1e3a06dfb81f86e777. The affected component should be upgraded. | medium | 2026-10-26 |
| CVE-2013-10077 | A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases. | medium | 2026-10-26 |
| CVE-2012-20006 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | No Score | 2026-10-26 |
| CVE-2026-9863 | Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling. | high | 2026-10-25 |
| CVE-2026-9862 | Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing. | critical | 2026-10-25 |
| CVE-2026-9836 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability. | high | 2026-10-25 |
