|
cve-2026-100380
|
5.3 (v4.0)
|
Reflected XSS in Wikibase Special:SetLabel language va…
|
Wikimedia Foundation
|
Mediawiki - Wikibase Extension
|
2026-09-25T20:58:24.004Z |
2026-09-26T22:51:17.986Z |
|
cve-2026-100379
|
5.3 (v4.0)
|
Cross-request disclosure of CentralAuth cookies in Wik…
|
Wikimedia Foundation
|
Wikipedia Android App
|
2026-09-25T20:54:08.355Z |
2026-09-26T22:51:18.194Z |
|
cve-2026-91767
|
6.5 (v3.1)
|
Heap-buffer-overflow in php_openssl_matches_wildcard_n…
|
PHP Group
|
PHP
|
2026-09-25T20:53:42.587Z |
2026-09-28T13:31:31.640Z |
|
cve-2026-100378
|
5.3 (v4.0)
|
Missing permission check in the Translate sandbox doRe…
|
Wikimedia Foundation
|
Mediawiki - Translate Extension
|
2026-09-25T20:50:28.366Z |
2026-09-26T22:51:18.316Z |
|
cve-2026-10758
|
7.5 (v3.1)
|
Esri Lerc has a security vulnerability
|
Esri
|
Lerc
|
2026-09-25T20:49:43.438Z |
2026-09-26T22:51:18.457Z |
|
cve-2026-100376
|
4.8 (v4.0)
|
TemplateSandbox can be abused for XSS by asking anothe…
|
Wikimedia Foundation
|
Mediawiki - TemplateSandbox Extension
|
2026-09-25T20:48:53.688Z |
2026-09-26T22:51:18.594Z |
|
cve-2025-1218
|
3.4 (v3.1)
|
Various packet overreads in mysqlnd_writeprotocol.c
|
PHP Group
|
PHP
|
2026-09-25T20:48:21.777Z |
2026-09-28T13:31:31.774Z |
|
cve-2026-100377
|
6.9 (v4.0)
|
Revision-deleted pages can be viewed through WikiLambd…
|
Wikimedia Foundation
|
Mediawiki - WikiLambda Extension
|
2026-09-25T20:47:36.756Z |
2026-09-26T22:51:18.721Z |
|
cve-2026-91766
|
5.9 (v3.1)
|
Cross-origin credential leak in HTTP stream wrapper re…
|
PHP Group
|
PHP
|
2026-09-25T20:40:25.040Z |
2026-09-28T13:31:31.921Z |
|
cve-2026-57443
|
|
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API…
|
issdandavis
|
SCBE-AETHERMOORE
|
2026-09-25T20:37:52.116Z |
2026-09-29T17:45:46.289Z |
|
cve-2026-91765
|
7.5 (v3.1)
|
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
|
PHP Group
|
PHP
|
2026-09-25T20:33:03.634Z |
2026-09-28T13:31:32.047Z |
|
cve-2026-100369
|
|
CliInvoke: Argument Injection in Extensibility Runner …
|
alastairlundy
|
CliInvoke
|
2026-09-25T20:26:51.352Z |
2026-09-28T13:42:58.777Z |
|
cve-2025-14181
|
6.5 (v3.1)
|
Integer overflow to buffer overflow in soap HTTP parsing
|
PHP Group
|
PHP
|
2026-09-25T20:26:45.445Z |
2026-09-25T20:44:13.720Z |
|
cve-2026-100417
|
2.3 (v4.0)
3.1 (v3.1)
|
RustDesk before 1.5.0 One-Way File Transfer Bypass
|
rustdesk
|
rustdesk
|
2026-09-25T20:25:18.041Z |
2026-09-30T00:09:30.175Z |
|
cve-2026-17545
|
6.9 (v4.0)
|
PHP on Windows: Reserved Device Names Are Not Rejected…
|
PHP Group
|
PHP
|
2026-09-25T20:18:11.288Z |
2026-09-25T20:43:34.157Z |
|
cve-2026-100391
|
8.8 (v4.0)
8.2 (v3.1)
|
MediaFlow Proxy through 2.4.9 Server-Side Request Forg…
|
mhdzumair
|
mediaflow-proxy
|
2026-09-25T20:13:12.968Z |
2026-10-05T14:55:05.292Z |
|
cve-2026-100390
|
9.1 (v4.0)
7.4 (v3.1)
|
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Fo…
|
tobychui
|
zoraxy
|
2026-09-25T20:13:09.522Z |
2026-09-25T20:42:50.268Z |
|
cve-2026-100389
|
9.2 (v4.0)
8.1 (v3.1)
|
GestSup before 3.2.62 Remote Code Execution via IMAP A…
|
GestSup
|
GestSup
|
2026-09-25T20:13:07.623Z |
2026-09-30T11:15:12.444Z |
|
cve-2026-100388
|
5.3 (v4.0)
5.4 (v3.1)
|
RustDesk before 1.5.0 Missing Authorization Check on I…
|
rustdesk
|
rustdesk
|
2026-09-25T20:13:06.546Z |
2026-09-30T00:08:08.572Z |
|
cve-2026-100387
|
7.2 (v4.0)
8.1 (v3.1)
|
pgPointcloud through 1.2.5 heap out-of-bounds read via…
|
pgpointcloud
|
pointcloud
|
2026-09-25T20:13:05.306Z |
2026-09-30T17:29:31.830Z |
|
cve-2026-96879
|
6.9 (v4.0)
|
"Checked by" label in page history should not be shown…
|
The Wikimedia Foundation
|
Mediawiki - FlaggedRevs extension
|
2026-09-25T20:10:22.476Z |
2026-09-29T21:22:40.501Z |
|
cve-2026-6103
|
4.3 (v3.1)
|
Phar TAR phar_tar_number() Integer Overflow - Archive …
|
PHP Group
|
PHP
|
2026-09-25T20:08:49.333Z |
2026-09-25T20:41:27.115Z |
|
cve-2026-93682
|
5.8 (v3.1)
|
Out-of-bounds read in the HTTP stream wrapper when fol…
|
PHP Group
|
PHP
|
2026-09-25T20:02:11.467Z |
2026-09-25T20:38:14.346Z |
|
cve-2026-100368
|
|
CliInvoke.Specializations: Command injection in PowerS…
|
alastairlundy
|
CliInvoke.Specializations
|
2026-09-25T19:53:56.299Z |
2026-09-30T00:06:47.101Z |
|
cve-2026-96878
|
6.9 (v4.0)
|
Cargo Exhibit field alias allows stored XSS
|
The Wikimedia Foundation
|
Mediawiki - Cargo extension
|
2026-09-25T19:41:56.483Z |
2026-09-29T21:21:41.691Z |
|
cve-2026-96877
|
6.9 (v4.0)
|
Reflected XSS through Cargo Drilldown full-text search
|
The Wikimedia Foundation
|
Mediawiki - Cargo extension
|
2026-09-25T19:39:30.872Z |
2026-09-29T21:21:04.824Z |
|
cve-2026-100208
|
7.5 (v3.1)
|
Microsoft Office Outlook Remote Code Execution Vulnerability
|
Microsoft
|
Microsoft 365 Apps for Enterprise
|
2026-09-25T19:39:27.315Z |
2026-10-30T17:23:06.582Z |
|
cve-2026-100373
|
5.1 (v4.0)
4.1 (v3.1)
|
OpenMetadata through 2.0.2 SSRF via Webhook URL Valida…
|
open-metadata
|
OpenMetadata
|
2026-09-25T19:38:29.984Z |
2026-09-25T20:37:23.124Z |
|
cve-2026-100372
|
8.6 (v4.0)
7.2 (v3.1)
|
ClipBucket v5 before 5.5.3-#197 Path Traversal via tem…
|
MacWarrior
|
clipbucket-v5
|
2026-09-25T19:38:29.217Z |
2026-10-06T13:36:48.337Z |
|
cve-2026-100310
|
7.3 (v4.0)
7 (v3.1)
|
GNU libextractor before 1.16 Privilege Escalation via …
|
GNU
|
libextractor
|
2026-09-25T19:38:28.517Z |
2026-09-30T00:05:50.934Z |