Archive
7 October 2026
Vulnerabilities first published on this day (UTC), newest first.
12 results · Clear filters · Feed
-
Critical 9.8
Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST) Application Programming Interface (API) on a search head cluster member could execute attacker-controlled …
-
Critical 9.3CVE-2026-92414 Public exploit
Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issu…
-
High 8.1CVE-2026-107181 Public exploit
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme han…
-
Medium 6.1CVE-2026-102258 Public exploit
Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Manage…
-
High 7.2CVE-2026-102257 Public exploit
A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extra…
-
High 7.8CVE-2026-102256 Public exploit
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
-
Critical 10.0CVE-2026-102255 Public exploit
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…
-
Medium 6.5CVE-2026-107159 Public exploit
MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known S…
-
Critical 9.8CVE-2026-105192 Public exploit
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which …
-
Critical 9.3
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request para…
-
Critical 9.3CVE-2026-59346 Public exploit
VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability
VMware Workstation and Fusion contain an integer-overflow vulnerability. A malicious actor with local administrative privileges on a virtual machine with VMXNET3 virtual network adapter may exploit this issue to execute code on the host. Affected versions: - …
-
Critical 9.8
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.