CVE ID :CVE-2026-112001 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner’s credentials via PATCH Attackers…
CVE ID :CVE-2026-112005 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions…
CVE ID :CVE-2026-112006 Published : Oct. 18, 2026, 12:17 p.m. | 6 hours, 57 minutes ago Description :OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate…
CVE ID :CVE-2026-111927 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs…
CVE ID :CVE-2026-111924 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small,…
CVE ID :CVE-2026-111923 Published : Oct. 17, 2026, 6:46 p.m. | 18 minutes ago Description :Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send…
CVE ID :CVE-2026-111911 Published : Oct. 17, 2026, 6:46 p.m. | 19 minutes ago Description :phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage…
CVE ID :CVE-2026-111909 Published : Oct. 17, 2026, 6:46 p.m. | 19 minutes ago Description :phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission to delete superadmin accounts. Attackers can…
CVE ID :CVE-2026-96620 Published : Oct. 16, 2026, 8:18 p.m. | 42 minutes ago Description :Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token…
CVE ID :CVE-2026-61726 Published : Oct. 16, 2026, 8:17 p.m. | 43 minutes ago Description :Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and…