Search
23 CVEs · published 2026-10-29 to 2026-10-29, Low severity
CVEs (23)
Showing 1–23 of 23
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-119280 | LOW | Patched | 3.7 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.r… |
| CVE-2026-118781 | LOW | Patched | 2.9 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.m… |
| CVE-2026-118780 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateC… |
| CVE-2026-118776 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC… |
| CVE-2026-118775 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the … |
| CVE-2026-118774 | LOW | Patched | 3.7 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(chi… |
| CVE-2026-93571 | LOW | Patched | — | 2026-10-29 | Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file … |
| CVE-2026-119133 | LOW | Patched | 2.6 | 2026-10-29 | Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd nu… |
| CVE-2026-119130 | LOW | Patched | 2.6 | 2026-10-29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form UR… |
| CVE-2026-119126 | LOW | Patched | 3.1 | 2026-10-29 | Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored … |
| CVE-2026-119125 | LOW | Patched | 3.1 | 2026-10-29 | Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients… |
| CVE-2026-115794 | LOW | Patched | — | 2026-10-29 | P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against… |
| CVE-2026-112255 | LOW | — | 2026-10-29 | Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Aut… | |
| CVE-2026-104312 | LOW | Patched | 3.5 | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the inten… |
| CVE-2026-119048 | LOW | 4.2 | 2026-10-29 | JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' co… | |
| CVE-2026-85498 | LOW | 3.5 | 2026-10-29 | A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during bu… | |
| CVE-2026-115303 | LOW | Patched | 3.7 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing e… |
| CVE-2026-85007 | LOW | Patched | 3.8 | 2026-10-29 | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role … |
| CVE-2026-108686 | LOW | Patched | 3.7 | 2026-10-29 | The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA se… |
| CVE-2026-108685 | LOW | Patched | 3.7 | 2026-10-29 | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenti… |
| CVE-2026-105258 | LOW | Patched | 3.5 | 2026-10-29 | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, a… |
| CVE-2024-3586 | LOW | Patched | 3.5 | 2026-10-29 | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cro… |
| CVE-2026-118585 | LOW | 3.5 | 2026-10-29 | A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab. This vulnerability affect… |