42 CVEs — updated 2026-11-03 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-65145 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue. This vul | CRITICAL | 10.0 | 45%ile | NVD | 2026-10-27 |
| CVE-2026-18450 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to c | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-27 |
| CVE-2026-82116 | Missing Authentication for Critical Function Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from | CRITICAL | 9.8 | 49%ile | NVD | 2026-10-27 |
| CVE-2026-103409 | A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthen | CRITICAL | 9.8 | 28%ile | NVD | 2026-10-28 |
| CVE-2026-79589 | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker | CRITICAL | 9.8 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-63377 | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language | CRITICAL | 9.8 | 34%ile | NVD | 2026-10-30 |
| CVE-2026-62863 | MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its | CRITICAL | 9.6 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-90465 | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster i | CRITICAL | 9.4 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-112197 | Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Java RMI service. An a | CRITICAL | 9.4 | 32%ile | NVD | 2026-10-28 |
| CVE-2026-82104 | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 thr | CRITICAL | 9.4 | 33%ile | NVD | 2026-10-30 |
| CVE-2026-61729 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, | CRITICAL | 9.4 | 32%ile | NVD | 2026-10-30 |
| CVE-2026-118690 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attacke | CRITICAL | 9.3 | 53%ile | NVD | 2026-10-28 |
| CVE-2026-61730 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected depl | CRITICAL | 9.3 | 31%ile | NVD | 2026-10-30 |
| CVE-2026-93865 | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenti | CRITICAL | 9.2 | 40%ile | NVD | 2026-10-27 |
| CVE-2026-120446 | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API be | HIGH | 8.8 | — | NVD | 2026-11-02 |
| CVE-2026-106087 | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read | HIGH | 8.7 | 16%ile | NVD | 2026-10-27 |
| CVE-2026-112350 | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unau | HIGH | 8.7 | 61%ile | NVD | 2026-10-27 |
| CVE-2026-92744 | Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as | HIGH | 8.7 | 17%ile | NVD | 2026-10-29 |
| CVE-2026-22110 | The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brut | HIGH | 8.7 | 15%ile | NVD | 2026-10-30 |
| CVE-2026-62302 | MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `re | HIGH | 8.7 | 40%ile | NVD | 2026-10-30 |
| CVE-2026-63396 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query. | HIGH | 8.7 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-119731 | Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at P | HIGH | 8.7 | — | NVD | 2026-11-02 |
| CVE-2026-61542 | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, | HIGH | 8.6 | 24%ile | NVD | 2026-10-28 |
| CVE-2026-113387 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secre | HIGH | 8.6 | 21%ile | NVD | 2026-10-29 |
| CVE-2026-77877 | Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attacke | HIGH | 8.6 | — | NVD | 2026-11-02 |
| CVE-2026-104189 | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file | HIGH | 7.5 | 29%ile | NVD | 2026-10-27 |
| CVE-2026-62264 | PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, | HIGH | 7.5 | 39%ile | NVD | 2026-10-30 |
| CVE-2026-61571 | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control | HIGH | 7.3 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-88810 | A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules | HIGH | 7.2 | — | NVD | 2026-11-02 |
| CVE-2026-119740 | Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART | HIGH | 7.0 | — | NVD | 2026-11-02 |
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | HIGH | — | 45%ile | CISA-KEV | 2026-10-30 |
| CVE-2026-119705 | SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthen | MEDIUM | 6.9 | 50%ile | NVD | 2026-10-30 |
| CVE-2026-63399 | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, the `GraphQL` `Mutation.createOrg` operati | MEDIUM | 6.9 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-120314 | Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows | MEDIUM | 6.9 | — | NVD | 2026-11-02 |
| CVE-2026-88941 | Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerabil | MEDIUM | 6.2 | 4%ile | NVD | 2026-10-29 |
| CVE-2026-104381 | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthentica | MEDIUM | 6.0 | 3%ile | NVD | 2026-10-27 |
| CVE-2026-119186 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, nod | MEDIUM | 5.9 | 11%ile | NVD | 2026-10-29 |
| CVE-2026-120191 | A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of t | MEDIUM | 5.5 | 57%ile | NVD | 2026-11-01 |
| CVE-2026-120278 | A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the | MEDIUM | 5.5 | — | NVD | 2026-11-02 |
| CVE-2026-111500 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerabili | MEDIUM | 5.4 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-102816 | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthent | MEDIUM | 5.3 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-86106 | Security Advisory 0179 | UNKNOWN | — | 29%ile | Arista | 2026-09-09 |