Search
216 CVEs · published 2026-10-29 to 2026-10-29, Medium severity
CVEs (216)
Showing 1–25 of 216
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-61673 | MEDIUM | Patched | — | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results fro… |
| CVE-2026-119317 | MEDIUM | 6.5 | 2026-10-29 | On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with the privileges of the nessusd proc… | |
| CVE-2026-119285 | MEDIUM | Patched | 5.9 | 2026-10-29 | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips… |
| CVE-2026-119284 | MEDIUM | Patched | — | 2026-10-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserializat… |
| CVE-2026-119281 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the connector assumed resul… |
| CVE-2026-119279 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.10, the ReadableByteBuf.readLen… |
| CVE-2026-119278 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7 and 3.4.5, during caching_sha2_password authent… |
| CVE-2026-119277 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, decoders for OK packet sess… |
| CVE-2026-119276 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, when CLIENT_SESSION_TRACK w… |
| CVE-2026-119210 | MEDIUM | Patched | 5.9 | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateL… |
| CVE-2026-119201 | MEDIUM | Patched | 4.8 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-se… |
| CVE-2026-119200 | MEDIUM | Patched | 6.5 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nit… |
| CVE-2026-119199 | MEDIUM | Patched | 5.9 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev… |
| CVE-2026-119198 | MEDIUM | Patched | 5.9 | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:clie… |
| CVE-2026-119193 | MEDIUM | Patched | — | 2026-10-29 | PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the TestCase::coverageFilesDirectory() logic in src/Runner/Phpt/TestCase.php creates temporary files for P… |
| CVE-2026-119189 | MEDIUM | Patched | 5.9 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicCons… |
| CVE-2026-119186 | MEDIUM | Patched | 5.9 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge did not validate the AES-GCM tagLength optio… |
| CVE-2026-6877 | MEDIUM | Patched | — | 2026-10-29 | ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerabilit… |
| CVE-2026-119251 | MEDIUM | 6.7 | 2026-10-29 | A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on … | |
| CVE-2026-118778 | MEDIUM | Patched | 5.9 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used forge.tls.createConnec… |
| CVE-2026-118777 | MEDIUM | Patched | 4.8 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths fro… |
| CVE-2026-118773 | MEDIUM | Patched | — | 2026-10-29 | Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCB… |
| CVE-2026-118768 | MEDIUM | Patched | — | 2026-10-29 | Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access UR… |
| CVE-2026-118767 | MEDIUM | Patched | 4.8 | 2026-10-29 | Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char* values without consistently… |
| CVE-2026-118766 | MEDIUM | Patched | 6.1 | 2026-10-29 | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's … |