Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
54256
Total
4300
Critical
16127
High
15827
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-103055 | HIGH | 7.5 | AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is … | Sep 30, 2026 |
| CVE-2026-103054 | HIGH | 7.1 | AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. … | Sep 30, 2026 |
| CVE-2026-103053 | MEDIUM | 5.4 | AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MODE is enabled and AISOC_ACTIONS_SERVICE_TOKEN is empty in the default … | Sep 30, 2026 |
| CVE-2026-102842 | MEDIUM | 6.3 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component … | Sep 30, 2026 |
| CVE-2026-102805 | MEDIUM | 6.5 | A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in the library stb_image_write.h of the component Image Encoding. … | Sep 30, 2026 |
| CVE-2026-102804 | MEDIUM | 6.5 | A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the function hexwave_init in the library stb_hexwave.h. Performing a manipulation of … | Sep 30, 2026 |
| CVE-2026-90441 | UNKNOWN | — | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to … | Sep 30, 2026 |
| CVE-2026-86136 | UNKNOWN | — | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to … | Sep 30, 2026 |
| CVE-2026-86133 | UNKNOWN | — | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash … | Sep 30, 2026 |
| CVE-2026-86132 | UNKNOWN | — | An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially … | Sep 30, 2026 |
| CVE-2026-86131 | UNKNOWN | — | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute … | Sep 30, 2026 |
| CVE-2026-86128 | UNKNOWN | — | A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a … | Sep 30, 2026 |
| CVE-2026-86105 | UNKNOWN | — | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are … | Sep 30, 2026 |
| CVE-2026-86104 | UNKNOWN | — | An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending … | Sep 30, 2026 |
| CVE-2026-86101 | UNKNOWN | — | An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to … | Sep 30, 2026 |
| CVE-2026-81433 | UNKNOWN | — | A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attacker with adjacent network access to execute arbitrary code … | Sep 30, 2026 |
| CVE-2026-18145 | UNKNOWN | — | A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service … | Sep 30, 2026 |
| CVE-2026-18105 | UNKNOWN | — | An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's … | Sep 30, 2026 |
| CVE-2026-13224 | UNKNOWN | — | A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem … | Sep 30, 2026 |
| CVE-2026-13046 | UNKNOWN | — | A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability … | Sep 30, 2026 |
| CVE-2026-103051 | MEDIUM | 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects … | Sep 30, 2026 |
| CVE-2026-103050 | MEDIUM | 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects … | Sep 30, 2026 |
| CVE-2026-103049 | MEDIUM | 6.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects … | Sep 30, 2026 |
| CVE-2026-103048 | UNKNOWN | — | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection extension allows Fake the Source of Data. This issue affects … | Sep 30, 2026 |
| CVE-2026-102794 | CRITICAL | 9.1 | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument … | Sep 30, 2026 |