| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-127275 | 10.0 | A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes mi | 2026-11-13 23:17:17 | 2026-11-13 00:20:14 |
| CVE-2026-126955 | 5.3 | Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{pag | 2026-11-13 23:17:16 | 2026-11-13 10:18:03 |
| CVE-2026-126395 | 5.3 | vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /t | 2026-11-13 23:17:16 | 2026-11-13 10:17:43 |
| CVE-2026-126298 | 7.5 | NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree p | 2026-11-13 23:17:16 | 2026-11-13 10:17:34 |
| CVE-2026-126294 | 7.5 | Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form | 2026-11-13 23:17:16 | 2026-11-13 10:17:33 |
| CVE-2026-126286 | 8.1 | NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send | 2026-11-13 23:17:16 | 2026-11-13 10:17:32 |
| CVE-2026-126366 | 7.5 | MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared s | 2026-11-13 23:17:16 | 2026-11-13 00:20:12 |
| CVE-2026-126358 | 5.3 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter p | 2026-11-13 23:17:16 | 2026-11-13 00:20:11 |
| CVE-2026-127029 | 7.5 | A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properl | 2026-11-13 23:17:16 | 2026-11-12 17:17:42 |
| CVE-2026-124726 | - | Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This | 2026-11-13 23:17:15 | 2026-11-13 18:17:32 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40249
Zapisa po stranici: