15 CVEs — updated 2026-11-03 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-61737 | ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret p | CRITICAL | 9.8 | 43%ile | NVD | 2026-10-30 |
| CVE-2026-61729 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, | CRITICAL | 9.4 | 32%ile | NVD | 2026-10-30 |
| CVE-2026-117564 | nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge a | CRITICAL | 9.3 | 49%ile | NVD | 2026-10-27 |
| CVE-2026-120442 | ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to for | CRITICAL | 9.3 | — | NVD | 2026-11-02 |
| CVE-2026-119736 | Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentia | HIGH | 8.8 | — | NVD | 2026-11-02 |
| CVE-2026-119662 | Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to au | HIGH | 8.7 | 37%ile | NVD | 2026-10-30 |
| CVE-2026-111419 | A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains thi | HIGH | 8.6 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-119335 | Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior | HIGH | 7.8 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-18449 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to c | HIGH | 7.5 | 27%ile | NVD | 2026-10-27 |
| CVE-2026-93855 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' paramete | HIGH | 7.5 | 35%ile | NVD | 2026-10-29 |
| CVE-2026-7003 | WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers | MEDIUM | 6.9 | 22%ile | NVD | 2026-10-30 |
| CVE-2026-101034 | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and | MEDIUM | 6.8 | 4%ile | NVD | 2026-10-27 |
| CVE-2026-44344 | Chamilo LMS is an open-source learning management system. In the 1.x line before 1.11.40, and the 2.x line before 2.0.1, | MEDIUM | 6.6 | 28%ile | NVD | 2026-10-30 |
| CVE-2026-118601 | Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjace | MEDIUM | 6.3 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-58930 | An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when r | UNKNOWN | — | — | NVD | 2026-11-02 |