CVE-2026-85097

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-107216

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls...

CVE-2026-107215

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory...

CVE-2026-56851

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer...

CVE-2026-107214

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values...

CVE-2026-107213

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but dereferences ws.Drawing without checking whether the independently optional drawing element exists. File.GetSlicers reads ws.Drawing.RID after seeing a...

CVE-2026-106067

A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width height and related arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size...

CVE-2026-106066

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, gmalloc sizing based on overflowing width height bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow...

CVE-2026-107212

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-82627

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-17609

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-17196

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-94154

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-107211

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while...

CVE-2026-96335

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2...

CVE-2026-95606

The WordPress The Events Calendar plugin (versions ≤ 6.17.4 ) is vulnerable to a PHP Object Injection vulnerability due to the deserialization of untrusted data . This flaw allows an attacker to inject objects, potentially leading to significant impact on confidentiality, integrity, and availabil...

CVE-2026-95605

The Passionate Programmer Peter WP Data Access WordPress plugin is vulnerable to Blind SQL Injection in versions up to and including 5.5.82 . The root cause is the Improper Neutralization of Special Elements used in an SQL Command (CWE-89). This vulnerability could allow an attacker to perform un...

CVE-2026-95595

The Disable and Remove Google Fonts | GDPR & DSGVO friendly WordPress plugin (versions

CVE-2026-95534

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting versions up to and including 2.0.19 , is vulnerable to a PHP Object Injection flaw. This issue stems from the deserialization of untrusted data , which could allow an attacker to execute arbitrary c...

CVE-2026-94670

The Everest Forms WordPress plugin (versions

CVE-2026-106065

A heap-based buffer overflow exists in GIMP's PCX export plug-in due to an integer overflow during size calculation. When processing images with extremely large width and height, the software uses overflowing 32-bit width * height arithmetic for buffer allocation, while subsequent GEGL operations...

CVE-2026-94662

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting versions up to and including 2.0.19 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation (CWE-79). This vulnerabil...

CVE-2026-92543

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-92542

A vulnerability in Linux Swarm allows for blind VXLAN injection into encrypted overlay networks. The root cause is that firewall rules marking VXLAN datagrams for encryption indiscriminately match both authentic kernel-sent datagrams and forged datagrams from user processes. Specifically, any UDP...

CVE-2026-106557

The Backstage framework (versions prior to 1.14.6 and 1.15.4 ) is vulnerable to improper input validation within the @backstage/plugin-techdocs-node package. An authenticated user capable of registering or modifying documentation sources can trigger a TechDocs build that accesses resources outsid...

CVE-2026-76472

The Cisco Meraki Security Hardening Release October 2026 addresses multiple internally discovered vulnerabilities categorized under CWE-74 (Improper Neutralization of Special Elements). These issues involve vulnerabilities where special elements are not properly neutralized in outputs used by dow...

CVE-2026-76467

The Cisco Meraki Software Hardening Release addresses multiple internally discovered vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These issues can impact availability , as indicated by a CVSS 3.1 score of 7.5. While the specific affected components and...

CVE-2026-76470

The Cisco Meraki networking platform is affected by multiple internally discovered vulnerabilities involving incorrect calculation issues, categorized under CWE-682 . These vulnerabilities were identified during a proactive internal security review by Cisco's networking engineering team. The impa...

CVE-2026-76469

The Cisco Meraki networking platform is affected by multiple insufficient control flow management vulnerabilities (CWE-691) identified during an internal security review. These issues are addressed in the October 2026 Security Hardening Release . The impact is categorized as HIGH availability, wi...

CVE-2026-76468

This CVE identifies multiple vulnerabilities in Cisco Meraki software resulting from improper input validation (CWE-20). These issues were identified during a proactive internal security review by Cisco's networking engineering team and are addressed in a software hardening release . The high-sev...

CVE-2026-76464

This CVE identifies buffer management vulnerabilities (CWE-119) within Cisco Meraki products. These issues were discovered during an internal security review by Cisco's networking engineering team and are addressed in a software hardening release dated October 2026. The impact is rated as CRITICA...

CVE-2026-76463

This CVE identifies improper access control vulnerabilities (CWE-284) within the Cisco Meraki software. These issues were discovered during an internal security review by Cisco's networking engineering team. The vulnerabilities are addressed in a software hardening release . The impact is rated a...

CVE-2026-76501

A vulnerability exists in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature, known as NGOAM , within Cisco NX-OS Software on Cisco Nexus 9000 Series Switches . The root cause is improper input validation of IP traffic when both NGOAM and SRv6 features a...

CVE-2026-76500

The Cisco Application Policy Infrastructure Controller (APIC) is affected by vulnerabilities involving improper control of a resource through its lifetime (CWE-664). These issues were identified during an internal security review and are addressed in the October 2026 hardening release . The impac...

CVE-2026-76498

The Cisco Application Policy Infrastructure Controller (APIC) is affected by multiple improper access control vulnerabilities, categorized under CWE-284 . These issues were identified during an internal security review by the engineering team and are addressed in the October 2026 hardening releas...

CVE-2026-76499

The Cisco Application Policy Infrastructure Controller (APIC) is affected by improper neutralization vulnerabilities (CWE-707) identified during a proactive internal security review. These vulnerabilities are addressed in the Hardening Release: October 2026 . The issues have a CRITICAL severity (...

CVE-2026-76486

A vulnerability exists in the VXLAN Operation, Administration, and Maintenance (OAM) feature, known as NGOAM , within Cisco NX-OS Software running on Nexus 3000 and 9000 Series Switches . The flaw is caused by improper input validation of IP traffic when the NGOAM feature is active. An unauthenti...

CVE-2026-76488

A vulnerability exists in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) due to insufficient access control to file system resources. An authenticated, remote attacker with valid administrative credentials can exploit this by submitting crafted valu...

CVE-2026-76484

The Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) software is subject to a security hardening release addressing multiple internally discovered vulnerabilities. These issues are characterized by insufficient protection against code injection (CWE-94). The vulnerabilities ...

CVE-2026-76485

A vulnerability exists in the VXLAN Operation, Administration, and Maintenance (OAM) feature, known as NGOAM , in Cisco NX-OS Software running on Nexus 3000 and 9000 Series Switches . The root cause is improper input validation of IP traffic when the NGOAM feature is enabled. An unauthenticated, ...

CVE-2026-76483

The Cisco License On-Prem software (formerly Cisco Smart Software Manager On-Prem ) is affected by vulnerabilities involving insufficiently protected credentials (CWE-522 ). These issues were identified during an internal security review and are addressed in Cisco's Security Hardening Release . T...

CVE-2026-76482

The Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem ) software is affected by vulnerabilities categorized under CWE-347 , involving improper verification of cryptographic signatures . These issues were identified during an internal security review and are addressed through so...

CVE-2026-76480

The Cisco License On-Prem software (formerly known as Cisco Smart Software Manager On-Prem ) is affected by multiple vulnerabilities grouped under CVE-2026-76480 . These issues are characterized by improper authentication (CWE-306), specifically involving missing authentication for critical funct...

CVE-2026-76458

The Cisco NX-OS Software is affected by vulnerabilities involving the improper handling of exceptional conditions (CWE-703), as identified during a proactive internal security review. The high-severity issue (CVSS 3.1: 8.6) primarily impacts availability and can be triggered over a network with l...

CVE-2026-76459

The Cisco NX-OS Software is affected by out-of-bounds write vulnerabilities, categorized under CWE-787 . These issues were identified during an internal security review by the Cisco NX-OS engineering team. The vulnerabilities are addressed in a software hardening release dated October 2026. The C...

CVE-2026-76471

A vulnerability in the NX-API feature of Cisco NX-OS Software allows an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) . The root cause is insufficient input validation of data sent to the NX-API. An attacker can exploit this by ...

CVE-2026-76455

The Cisco NX-OS Software is affected by multiple vulnerabilities categorized as Improper Access Control (CWE-284). These issues were identified during an internal security review and are addressed in the October 2026 Software Security Hardening Release . The vulnerabilities are assigned a CRITICA...

CVE-2026-76457

The Cisco NX-OS Software is subject to multiple out-of-bounds read vulnerabilities, identified under CWE-125 , following an internal security review. These issues are addressed in the October 2026 Software Security Hardening Release . The vulnerabilities have a HIGH base severity (CVSS 3.1: 8.6) ...

CVE-2026-76456

The Cisco NX-OS Software is affected by multiple vulnerabilities categorized under CWE-20 (Improper Input Validation) . These issues stem from the improper validation of special elements used in a command issue. The Cisco NX-OS engineering team identified these vulnerabilities through an internal...

CVE-2026-106108

The Quasar Framework contains a vulnerability where App Vite SSG page output paths can escape the configured distribution directory. During an SSG build, the builder joins dir and filename values from getSsgPages() with build.distDir without verifying that the final destination remains within the...