CVE-2026-0993 - SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary Parser
CVE ID :CVE-2026-0993
Published : Oct. 15, 2026, 1:19 a.m. | 1 hour, 28 minutes ago
Description :SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-0993
Published : Oct. 15, 2026, 1:19 a.m. | 1 hour, 28 minutes ago
Description :SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP server's multipart/form-data boundary parser to cause the device to become fully unresponsive — dropping all management access and traffic forwarding during its self-recovery cycle.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110810 - ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
CVE ID :CVE-2026-110810
Published : Oct. 15, 2026, 1:19 a.m. | 1 hour, 28 minutes ago
Description :A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 2.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110810
Published : Oct. 15, 2026, 1:19 a.m. | 1 hour, 28 minutes ago
Description :A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whisper_model_load of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity: 2.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110907 - Backdrop CMS Token Browser Information Disclosure
CVE ID :CVE-2026-110907
Published : Oct. 15, 2026, 2:09 a.m. | 38 minutes ago
Description :Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110907
Published : Oct. 15, 2026, 2:09 a.m. | 38 minutes ago
Description :Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76662 - HPE NonStop TELSERV - Memory corruption vulnerability
CVE ID :CVE-2026-76662
Published : Oct. 15, 2026, 2:11 a.m. | 36 minutes ago
Description :A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76662
Published : Oct. 15, 2026, 2:11 a.m. | 36 minutes ago
Description :A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76663 - HPE NonStop TELSERV - Memory corruption vulnerability
CVE ID :CVE-2026-76663
Published : Oct. 15, 2026, 2:16 a.m. | 31 minutes ago
Description :A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76663
Published : Oct. 15, 2026, 2:16 a.m. | 31 minutes ago
Description :A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-109430 - Ellucian WebAdvisor 3.2 Unauthenticated XXE Injection
CVE ID :CVE-2026-109430
Published : Oct. 15, 2026, 2:18 a.m. | 29 minutes ago
Description :Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-109430
Published : Oct. 15, 2026, 2:18 a.m. | 29 minutes ago
Description :Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) injection vulnerability that allows remote attackers to submit crafted XML POST requests to the /WebAdvisor/WebAdvisor endpoint without disabling external entity and DTD resolution. Attackers can exploit this flaw to force the server into SSRF requests, coerce NTLMv2 hash disclosure via attacker-controlled SMB shares, and read arbitrary files from the underlying Windows host through an out-of-band error-based channel. WebAdvisor entered end-of-support status in June 2022 and users are encouraged to migrate to Colleague Self-Service.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110904 - ApostropheCMS Authentication Bypass
CVE ID :CVE-2026-110904
Published : Oct. 15, 2026, 2:18 a.m. | 29 minutes ago
Description :ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110904
Published : Oct. 15, 2026, 2:18 a.m. | 29 minutes ago
Description :ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-73799 - HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability
CVE ID :CVE-2026-73799
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-73799
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76066 - IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode
CVE ID :CVE-2026-76066
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76066
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :IntentKit through 2.6.3 contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by ToolBindingMiddleware, allowing owner-only state-changing tools such as wallet transfer, posting, memory-write, and call-agent to execute without any human-in-the-loop or approval gate. An unauthenticated or public caller in WEB, API, TWITTER, or TELEGRAM contexts can exploit this by supplying the exact de-advertised tool name and arguments via indirect prompt injection or by replaying checkpoint and history data on a reused thread, achieving unauthorized execution of owner-restricted capabilities.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76656 - HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability
CVE ID :CVE-2026-76656
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76656
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76659 - HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability
CVE ID :CVE-2026-76659
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76659
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76660 - HPE NonStop CIPSAM - Memory corruption vulnerability
CVE ID :CVE-2026-76660
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76660
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76661 - HPE NonStop QIOMON - Memory corruption vulnerability
CVE ID :CVE-2026-76661
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76661
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-77931 - MoviePilot 3.1.5 Command Injection via ExecuteCommandTool
CVE ID :CVE-2026-77931
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-77931
Published : Oct. 15, 2026, 2:20 a.m. | 27 minutes ago
Description :MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata parsers, which then get passed to the unrestricted ExecuteCommandTool via asyncio.create_subprocess_shell. Attackers can craft content that instructs the model to invoke execute_command with confirm_dangerous set to true, bypassing the validate_command_safety denylist and exploiting the admin session's is_admin context to achieve remote code execution on the host.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-110908 - Netgate pfSense FRR Package OS Command Injection Vulnerability
CVE ID :CVE-2026-110908
Published : Oct. 15, 2026, 2:24 a.m. | 23 minutes ago
Description :Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-110908
Published : Oct. 15, 2026, 2:24 a.m. | 23 minutes ago
Description :Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76666 - HPE NonStop EXPAND - Out-of-Bounds memory read
CVE ID :CVE-2026-76666
Published : Oct. 15, 2026, 5:17 a.m. | 1 hour, 32 minutes ago
Description :A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76666
Published : Oct. 15, 2026, 5:17 a.m. | 1 hour, 32 minutes ago
Description :A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-76667 - HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability
CVE ID :CVE-2026-76667
Published : Oct. 15, 2026, 5:17 a.m. | 1 hour, 32 minutes ago
Description :A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-76667
Published : Oct. 15, 2026, 5:17 a.m. | 1 hour, 32 minutes ago
Description :A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-103304 - eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update
CVE ID :CVE-2026-103304
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-103304
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the emails the site sends.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-104643 - Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite
CVE ID :CVE-2026-104643
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-104643
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft posts and from site options, and to trigger a site-wide rewrite of those URLs, once an administrator has run a scan.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-106031 - Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result
CVE ID :CVE-2026-106031
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-106031
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, including unpublished ones.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-109145 - User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler
CVE ID :CVE-2026-109145
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-109145
Published : Oct. 15, 2026, 6 a.m. | 49 minutes ago
Description :The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthenticated attackers to register an administrator-equivalent account and take over the site.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...