boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Friday, October 16, 2026 · all times UTC← 2026-10-15 · archive

Security Box Score — October 16, 2026 — page 2

Edition of October 16, 2026, continued — page 2 of 2. Back to page 1

Results (continued, ranked) — ranks 401–458 of 458
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-1117165.3—nduckminkarkonCWE-639Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes
CVE-2026-1117175.3—nduckminkarkonCWE-639Arkon through 0.9.2 Missing Authorization via Skills Versions API
CVE-2026-1117215.3—jingsewuopen-wesCWE-639Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehous…
CVE-2026-1117285.3—5rahimSeanimeCWE-88Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings
CVE-2026-1076745.1—IBMiCWE-667IBM i is Affected by a Denial of Service in Digital Certificate Manager
CVE-2026-1098385.1—IBMDb2 Genius HubCWE-347IBM Db2 Genius Hub Improper verification of cryptographic signature
CVE-2026-1116045.1—elunezeladminCWE-639eladmin through 2.7 Broken Access Control via /api/users Update and Delete
CVE-2026-1116095.1—PKPOpen Journal SystemsCWE-639PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via …
CVE-2026-1116485.1—build-adminbuildadminCWE-639BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter
CVE-2026-1116555.1—zoujinglithink-plugs-adminCWE-639ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit
CVE-2026-1116585.1—SiteServerSSCMSCWE-639SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API
CVE-2026-1117135.1—AmauriCtarteaucitron.jsCWE-79tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
CVE-2026-965425.0—Electronic ArtsEA Javelin Anticheat (EA Javelin Anticheat Installer)CWE-732EA Javelin Anticheat Installer Local Privilege Escalation
CVE-2026-623624.9—PBH-BTNPeerBanHelperCWE-89PeerBanHelper: SQL injection via ${field} interpolation in MyBatis mapper for…
CVE-2026-1116644.8—safingportmasterCWE-306Safing Portmaster before 2.2.5 Unauthenticated Forced Downgrade via /api/v1/u…
CVE-2026-1116784.8—Adri van OsantiwordCWE-125Antiword through 0.37 Stack Out-of-Bounds Read via prop8.c FKP Parsing
CVE-2026-1091184.6—ikus-softrdiffwebCWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…
CVE-2026-174884.3—IBMiCWE-287IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
CVE-2026-574474.3—discoursediscourse-doc-categoriesCWE-200Discourse Doc Categories: Doc category index refresh leaks private topic titles
CVE-2026-857454.3—MariaDBserverCWE-126MariaDB: Out-of-bound buffer read on in `ST_Area` of a multipolygon.
CVE-2026-966284.3—getarcaneapparcaneCWE-863Arcane: Environment access token bypasses the admin-required authorization ga…
CVE-2026-1102874.3—DevolutionsServerCWE-863Improper access control in asset contact password in Devolutions Server 2026.…
CVE-2026-1108044.3—DevolutionsServerCWE-915Improperly controlled modification of JIT elevation settings in PAM checkout …
CVE-2026-1117934.3—Openwave Messaging (Ireland) LimitedWebtop Media TranscoderCWE-669Openwave Webtop Media Transcoder does not enforce administrator-defined file …
CVE-2026-172753.7—IBMiCWE-285IBM i is Affected by an Improper Validation Vulnerability
CVE-2026-175913.6—Red HatRed Hat Enterprise Linux 10CWE-416Libarchive: libarchive: use-after-free via aliased mac metadata copy
CVE-2026-1115813.3—Red HatRed Hat Enterprise Linux 10CWE-88Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpe…
CVE-2026-1098393.1—IBMDb2 Genius HubCWE-325IBM Db2 Genius Hub Missing Cryptographic Step
CVE-2026-1108052.6—DevolutionsServerCWE-918Server-side request forgery in PingOne groups endpoint in Devolutions Server …
CVE-2026-1116082.3—jeequanjeepayCWE-639Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
CVE-2026-1116282.3—10upDistributorCWE-50210up Distributor before 2.3.2 PHP Object Injection via set_meta()
CVE-2026-1117142.3—AmauriCtarteaucitron.jsCWE-1333tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
CVE-2025-52097await—n/an/a—Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.…
CVE-2025-55640await—n/an/a—A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) o…
CVE-2025-55653await—n/an/a—GPAC MP4Box v2.4 was discovered to contain a floating point exception in the …
CVE-2025-66969await—n/an/a—Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
CVE-2026-26846await—n/an/a—Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_2025102…
CVE-2026-46471await—n/an/a—An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While pa…
CVE-2026-63619await—Apache Software FoundationApache KylinCWE-862Apache Kylin: Missing authorization and path-confinement on system meta dump
CVE-2026-64610await—Apache Software FoundationApache KylinCWE-502Apache Kylin: Redis unsafe Java deserialization
CVE-2026-64959await—Apache Software FoundationApache KylinCWE-89Apache Kylin: Missing authentication on certain cache API endpoints
CVE-2026-68571await—Apache Software FoundationApache KylinCWE-94Apache Kylin: JDBC URL Whitelist Verification Bypass
CVE-2026-68572await—Apache Software FoundationApache KylinCWE-200Apache Kylin: Unauthorized SQL execution to Spark SQL env
CVE-2026-68573await—Apache Software FoundationApache KylinCWE-287Apache Kylin: Unauthenticated Metastore Cleanup
CVE-2026-69076await—Apache Software FoundationApache KylinCWE-200Apache Kylin: Unauthorized cross-project job discard
CVE-2026-69077await—Apache Software FoundationApache KylinCWE-200Apache Kylin: JobController allows unauthorized cross-project manipulation
CVE-2026-69080await—Apache Software FoundationApache KylinCWE-200Apache Kylin: Broken Access Control in QuerySQLBlacklistController
CVE-2026-95183await—n/an/a—An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c…
CVE-2026-108709await—Apache Software FoundationApache Kylin—Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
CVE-2026-108743await—Apache Software FoundationApache KylinCWE-78Apache Kylin: spark job OS command injection
CVE-2026-110752await——Text-CSV_XSCWE-770Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocat…
CVE-2026-110753await——Text-CSV_XSCWE-416Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of…
CVE-2026-110754await——Text-CSV_XSCWE-401Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record…
CVE-2026-110755await——Text-CSV_XSCWE-407Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying…
CVE-2026-110756await——Text-CSV_XSCWE-116Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its l…
CVE-2026-110757await——Text-CSV_XSCWE-116Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing …
CVE-2026-110758await——Text-CSV_XSCWE-127Text::CSV_XS versions before 1.65 for Perl read before the start of an all-bl…
CVE-2026-110759await——Text-CSV_XSCWE-1286Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in …