CVE ID :CVE-2026-115931 Published : Oct. 23, 2026, 11:17 p.m. | 57 minutes ago Description :Postiz lets a signed-in user ask the backend to run a function on one of their connected channels….
CVE-2026-115938 – Low privilege condition filter escapes Twig sandbox, recovers “securityKey” and reaches RCE
CVE ID :CVE-2026-115938 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is…
CVE-2026-115937 – Unauthenticated payment reuse allows unpaid orders to be marked as paid
CVE ID :CVE-2026-115937 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: *…
CVE-2026-115935 – Control panel only API response emulation replaces “securityKey” and reaches server RCE
CVE ID :CVE-2026-115935 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with…
CVE-2026-115895 – Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CVE ID :CVE-2026-115895 Published : Oct. 23, 2026, 10:16 p.m. | 1 hour, 58 minutes ago Description :Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. From 17.0.0…
CVE-2026-92450 – Kiloview E3 NDI Encoder Use of Hard-coded Credentials
CVE ID :CVE-2026-92450 Published : Oct. 22, 2026, 11:20 p.m. | 47 minutes ago Description :The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an…
CVE-2026-110825 – Kiloview E3 NDI Encoder Missing Authentication for Critical Function
CVE ID :CVE-2026-110825 Published : Oct. 22, 2026, 11:18 p.m. | 49 minutes ago Description :The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write…
CVE-2026-110243 – Kiloview E3 NDI Encoder OS Command Injection
CVE ID :CVE-2026-110243 Published : Oct. 22, 2026, 11:18 p.m. | 49 minutes ago Description :The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name…
CVE-2026-107861 – Kiloview E3 NDI Encoder OS Command Injection
CVE ID :CVE-2026-107861 Published : Oct. 22, 2026, 11:18 p.m. | 49 minutes ago Description :The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted…
CVE-2026-97785 – AAD App Proxy Elevation of Privilege Vulnerability
CVE ID :CVE-2026-97785 Published : Oct. 22, 2026, 10:20 p.m. | 1 hour, 47 minutes ago Description :Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network. Severity:…