CVE Feed
- CVE ID :CVE-2026-107376 Published : Oct. 8, 2026, 5:49 p.m. | 23 minutes ago Description :webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can submit deeply nested selection sets, object or list values, or list […]
- CVE ID :CVE-2026-107375 Published : Oct. 8, 2026, 5:36 p.m. | 37 minutes ago Description :JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from […]
- CVE ID :CVE-2026-93858 Published : Oct. 8, 2026, 5:28 p.m. | 44 minutes ago Description :In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly to paramiko.ProxyCommand() before any SSH connection to a gateway or target host is attempted. An authenticated project member can use the standard action-execution API to submit an […]
- CVE ID :CVE-2026-107333 Published : Oct. 8, 2026, 5:23 p.m. | 50 minutes ago Description :Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions […]
- CVE ID :CVE-2026-105436 Published : Oct. 8, 2026, 5:17 p.m. | 56 minutes ago Description :Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more…
- CVE ID :CVE-2026-104077 Published : Oct. 8, 2026, 5:17 p.m. | 56 minutes ago Description :Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient sanitization of the data-background-iframe attribute, which bypasses DOMPurify and is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin, […]
- CVE ID :CVE-2026-104078 Published : Oct. 8, 2026, 5:17 p.m. | 56 minutes ago Description :Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary code by embedding a crafted \href value with a TAB byte in the URL scheme, causing filterURL to produce […]
- CVE ID :CVE-2026-9209 Published : Oct. 8, 2026, 3:17 p.m. | 2 hours, 55 minutes ago Description :mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the runQueryButton postback and exportSqlQuery_Server PageMethod execute caller-supplied SQL against the backing Sybase SQL Anywhere database using DBA/sysadmin privileges with no server-side authentication […]
- CVE ID :CVE-2026-14992 Published : Oct. 8, 2026, 3:17 p.m. | 2 hours, 56 minutes ago Description :IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more…
- CVE ID :CVE-2026-14502 Published : Oct. 8, 2026, 3:17 p.m. | 2 hours, 56 minutes ago Description :IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication. Severity: 9.8 | CRITICAL Visit […]