CVE ID :CVE-2026-120189 Published : Nov. 1, 2026, 1:17 a.m. | 44 minutes ago Description :A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of…
CVE-2026-120135 – Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
CVE ID :CVE-2026-120135 Published : Oct. 31, 2026, 9:16 p.m. | 2 hours, 44 minutes ago Description :Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are…
CVE-2026-118636 – Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
CVE ID :CVE-2026-118636 Published : Oct. 31, 2026, 9:16 p.m. | 2 hours, 44 minutes ago Description :**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no…
CVE-2026-120209 – AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
CVE ID :CVE-2026-120209 Published : Oct. 31, 2026, 6:17 p.m. | 5 hours, 44 minutes ago Description :AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens…
CVE-2026-120205 – Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE ID :CVE-2026-120205 Published : Oct. 31, 2026, 6:17 p.m. | 5 hours, 44 minutes ago Description :Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject…
CVE-2026-120203 – ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates
CVE ID :CVE-2026-120203 Published : Oct. 31, 2026, 6:17 p.m. | 5 hours, 44 minutes ago Description :ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users…
CVE-2026-110176 – File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
CVE ID :CVE-2026-110176 Published : Oct. 31, 2026, 1:17 a.m. | 44 minutes ago Description :The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file…
CVE-2026-117656 – Unverified Sign in with Apple callback parameter can override verified ID token claims
CVE ID :CVE-2026-117656 Published : Oct. 31, 2026, 12:16 a.m. | 1 hour, 44 minutes ago Description :Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in…
CVE-2026-63396 – Coop has a data leak via unauthenticated GraphQL Query.allOrgs
CVE ID :CVE-2026-63396 Published : Oct. 30, 2026, 11:17 p.m. | 44 minutes ago Description :Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can…
CVE-2026-63393 – OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
CVE ID :CVE-2026-63393 Published : Oct. 30, 2026, 11:17 p.m. | 44 minutes ago Description :OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0…