CVE-2026-93442 - IBM QRadar SIEM Out-of-bounds Read
CVE ID :CVE-2026-93442
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-93442
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-93744 - IBM i Improper Authentication
CVE ID :CVE-2026-93744
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-93744
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-93888 - IBM Sterling Connect:Direct for Unix Buffer Overflow
CVE ID :CVE-2026-93888
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-93888
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-94402 - IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
CVE ID :CVE-2026-94402
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-94402
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-9825 - IBM Cyber Fraud Reachable Assertion
CVE ID :CVE-2026-9825
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-9825
Published : Oct. 20, 2026, 10:21 p.m. | 1 hour, 27 minutes ago
Description :IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-109681 - Metasploit Framework FTP PASV Response SSRF
CVE ID :CVE-2026-109681
Published : Oct. 20, 2026, 11:11 p.m. | 36 minutes ago
Description :The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-109681
Published : Oct. 20, 2026, 11:11 p.m. | 36 minutes ago
Description :The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-109682 - Metasploit Framework HTTP Redirect Server-Side Request Forgery
CVE ID :CVE-2026-109682
Published : Oct. 20, 2026, 11:12 p.m. | 35 minutes ago
Description :Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-109682
Published : Oct. 20, 2026, 11:12 p.m. | 35 minutes ago
Description :Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable from the operator's network, including internal services that are not otherwise accessible to the attacker.
Severity: 4.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113706 - a2aproject a2a-rs inmemory.rs information disclosure
CVE ID :CVE-2026-113706
Published : Oct. 20, 2026, 11:15 p.m. | 33 minutes ago
Description :A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113706
Published : Oct. 20, 2026, 11:15 p.m. | 33 minutes ago
Description :A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-112202 - Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images
CVE ID :CVE-2026-112202
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-112202
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected. The same code ships bundled in the Imager distribution. An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113705 - a2aproject a2a-rs error.rs information exposure
CVE ID :CVE-2026-113705
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113705
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-6945 - Rejected reason: This CVE ID has been rejected or
CVE ID :CVE-2026-6945
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-6945
Published : Oct. 20, 2026, 11:17 p.m. | 31 minutes ago
Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-113707 - a2aproject a2a-rs inmemory.rs update race condition
CVE ID :CVE-2026-113707
Published : Oct. 20, 2026, 11:30 p.m. | 18 minutes ago
Description :A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-113707
Published : Oct. 20, 2026, 11:30 p.m. | 18 minutes ago
Description :A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114104 - adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
CVE ID :CVE-2026-114104
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114104
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names. Attackers can craft archives where getEntry() returns the last duplicate while extractAllTo() writes the first, causing unvalidated bytes to be written to disk.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114105 - Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
CVE ID :CVE-2026-114105
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114105
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114106 - HKUDS Vibe-Trading 0.1.0 before 0.1.7 Path Traversal via read_document and safe_user_path
CVE ID :CVE-2026-114106
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114106
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114107 - HKUDS Vibe-Trading 0.1.0 before 0.1.7 Indirect Prompt Injection RCE via BashTool and BackgroundRunTool
CVE ID :CVE-2026-114107
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114107
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands as root by planting instructions in documents or web pages the agent processes. BashTool and BackgroundRunTool pass model-emitted commands to subprocess.run with shell=True and no allow-list or approval step, and read_url fetches arbitrary URLs, enabling command execution and server-side request forgery.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114108 - HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
CVE ID :CVE-2026-114108
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114108
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114109 - uv before 0.11.15 Arbitrary File Write via Entry Point Names
CVE ID :CVE-2026-114109
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114109
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114110 - Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries
CVE ID :CVE-2026-114110
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114110
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114111 - Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
CVE ID :CVE-2026-114111
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
Severity: 8.9 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114111
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific conditions, can lead to code execution on glibc-based Linux. An attacker can supply a crafted SVG image that, when decoded by sharp through librsvg, may result in arbitrary code execution.
Severity: 8.9 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-114112 - Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
CVE ID :CVE-2026-114112
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Severity: 8.9 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-114112
Published : Oct. 21, 2026, 1:17 a.m. | 2 hours, 31 minutes ago
Description :Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by supplying crafted images. Attackers can submit malicious AVIF/HEIF input to applications processing untrusted images with sharp, triggering libheif decoding flaws to execute code.
Severity: 8.9 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...