Latest CVEs

CVE-2026-96888 - Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
Published: October 21, 2026
CVE ID :CVE-2026-96888
Published : Oct. 21, 2026, 12:46 p.m. | 27 minutes ago
Description :A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Severity: 7.5 | HIGH

CVE-2026-94300 - Concurrent GSS-TSIG messages corrupt memory
Published: October 21, 2026
CVE ID :CVE-2026-94300
Published : Oct. 21, 2026, 12:45 p.m. | 28 minutes ago
Description :Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Severity: 8.1 | HIGH

CVE-2026-114245 - dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
Published: October 21, 2026
CVE ID :CVE-2026-114245
Published : Oct. 21, 2026, 12:45 p.m. | 28 minutes ago
Description :A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Severity: 0.0 | NA

CVE-2026-19630 - Amplified resource exhaustion in inbound message processing
Published: October 21, 2026
CVE ID :CVE-2026-19630
Published : Oct. 21, 2026, 12:41 p.m. | 32 minutes ago
Description :In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consume disproportionate amounts of CPU time and memory during processing. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.
Severity: 7.5 | HIGH

CVE-2026-114404 - PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
Published: October 21, 2026
CVE ID :CVE-2026-114404
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text runs, hyperlink relationship targets, or shape descr attributes that are emitted unescaped, executing script in viewers' browsers.
Severity: 6.1 | MEDIUM

CVE-2026-114403 - PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
Published: October 21, 2026
CVE ID :CVE-2026-114403
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPresentation.xml that IOFactory::load passes to unserialize(), enabling gadget-chain code execution, file writes, or denial of service.
Severity: 8.1 | HIGH

CVE-2026-114402 - Trudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Published: October 21, 2026
CVE ID :CVE-2026-114402
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.
Severity: 4.3 | MEDIUM

CVE-2026-114401 - Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Published: October 21, 2026
CVE ID :CVE-2026-114401
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes like (admin|root) or a.* and distinguish 'Invalid User' from 'Invalid Password' responses to discover valid accounts.
Severity: 5.3 | MEDIUM

CVE-2026-114400 - Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Published: October 21, 2026
CVE ID :CVE-2026-114400
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-guarded /uploads mount, attackers who know or guess a ticket ObjectId and filename can retrieve confidential attachments.
Severity: 5.9 | MEDIUM

CVE-2026-114399 - Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Published: October 21, 2026
CVE ID :CVE-2026-114399
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
Severity: 6.5 | MEDIUM

CVE-2026-114398 - Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
Published: October 21, 2026
CVE ID :CVE-2026-114398
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files served unauthenticated from /assets/, enabling stored cross-site scripting and replacement of instance branding.
Severity: 5.4 | MEDIUM

CVE-2026-114397 - Trudesk through 1.2.11 Missing Authentication on Debug Routes
Published: October 21, 2026
CVE ID :CVE-2026-114397
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using the password 'password'.
Severity: 7.4 | HIGH

CVE-2026-114396 - Trudesk through 1.2.11 MongoDB $where Injection via tickets search API
Published: October 21, 2026
CVE ID :CVE-2026-114396
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or leak full ticket documents including internal notes.
Severity: 7.1 | HIGH

CVE-2026-114395 - Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
Published: October 21, 2026
CVE ID :CVE-2026-114395
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v1/messages/send to inject spoofed messages into conversations they do not belong to.
Severity: 4.3 | MEDIUM

CVE-2026-114394 - Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
Published: October 21, 2026
CVE ID :CVE-2026-114394
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and ticket create requests to forge administrator-authored comments, internal notes, and tickets on any ticket.
Severity: 4.3 | MEDIUM

CVE-2026-114393 - Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Published: October 21, 2026
CVE ID :CVE-2026-114393
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change status, subject, group, priority or assignee, or mass-close tickets, since only the default tickets:update role grant is checked.
Severity: 4.3 | MEDIUM

CVE-2026-114392 - Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Published: October 21, 2026
CVE ID :CVE-2026-114392
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comments, owner and assignee, because the apiTickets.single handler skips group membership checks.
Severity: 4.3 | MEDIUM

CVE-2026-114391 - ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
Published: October 21, 2026
CVE ID :CVE-2026-114391
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like task.ajaxGetByID, system.ajaxDBAuthUrl and admin.ajaxChangeTableEngine to read data, obtain database credentials, trigger CI jobs and alter tables.
Severity: 7.1 | HIGH

CVE-2026-114390 - Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Published: October 21, 2026
CVE ID :CVE-2026-114390
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can call actions like get_users_by_group_course, user_by_all_roles, and export_all_certificates to harvest user names and other learners' certificate PDFs.
Severity: 5.3 | MEDIUM

CVE-2026-114389 - Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Published: October 21, 2026
CVE ID :CVE-2026-114389
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questionId values sent to the open_answer_grade endpoint to expose other students' answers through feedback and consume AI quota.
Severity: 4.3 | MEDIUM

CVE-2026-114388 - Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Published: October 21, 2026
CVE ID :CVE-2026-114388
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_default_certificate endpoint with any course id and document id to tamper with certificate configuration for any course.
Severity: 5.3 | MEDIUM

CVE-2026-114387 - Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
Published: October 21, 2026
CVE ID :CVE-2026-114387
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Permissions::togglePermission() directly over /livewire/update to create admin accounts and escalate to full administrator.
Severity: 8.8 | HIGH

CVE-2026-114386 - Pydantic AI Harness before 0.59.0 CodeMode Tool Call Limit Bypass via run_code
Published: October 21, 2026
CVE ID :CVE-2026-114386
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
Severity: 4.8 | MEDIUM

CVE-2026-114120 - SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
Published: October 21, 2026
CVE ID :CVE-2026-114120
Published : Oct. 21, 2026, 12:39 p.m. | 34 minutes ago
Description :SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Severity: 5.4 | MEDIUM

CVE-2026-114405 - Denial of Service via Malformed VATP Packet in Velneo vServer
Published: October 21, 2026
CVE ID :CVE-2026-114405
Published : Oct. 21, 2026, 12:27 p.m. | 46 minutes ago
Description :Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
Severity: 8.7 | HIGH