CVE-2026-107231 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-107230 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-105820 - Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal cons

CVE-2026-105818 - Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges

CVE-2026-105816 - Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference

CVE-2026-76286 - In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splunk platform authenti

CVE-2026-76285 - Improper Adherence to Coding Standards. Splunk addressed multiple internally identified vulnerabilit

CVE-2026-76284 - Improper Neutralization. Splunk addressed multiple internally identified vulnerabilities in Splunk E

CVE-2026-76283 - Protection Mechanism Failure. Splunk addressed multiple internally identified vulnerabilities in Spl

CVE-2026-76282 - Improper Control of a Resource Through its Lifetime. Splunk addressed multiple internally identified

CVE-2026-76281 - Improper Access Control. Splunk addressed multiple internally identified vulnerabilities in Splunk E

CVE-2026-76280 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway v

CVE-2026-76279 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role wi

CVE-2026-76278 - In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the e

CVE-2026-76277 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role wi

CVE-2026-76276 - In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not

CVE-2026-76275 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold th

CVE-2026-76274 - In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the r

CVE-2026-76273 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role wi

CVE-2026-76272 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold th

CVE-2026-76271 - In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not

CVE-2026-76270 - In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capa

CVE-2026-76269 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold th

CVE-2026-76268 - In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access t

CVE-2026-76267 - In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the r

CVE-2026-76266 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who c

CVE-2026-76265 - In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway v

CVE-2026-76264 - In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold th

CVE-2026-1403 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9

CVE-2026-107363 - In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in su

CVE-2026-107352 - Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed a

CVE-2026-107229 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-107228 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-107227 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-97717 - CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. A

CVE-2026-97716 - CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior

CVE-2026-97715 - CVE-2026-97715 is a vulnerability in the client registration process of Secure Access servers prior

CVE-2026-97714 - CVE-2026-97714 is a is a vulnerability in the authentication sub-system of Secure Access servers pri

CVE-2026-34499 - Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Co

CVE-2026-107355 - Rejected reason: ** This candidate has been removed by an organization.

CVE-2026-107354 - Rejected reason: ** This candidate has been removed by an organization.

CVE-2026-107353 - traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 thr

CVE-2026-107176 - A flaw was found in the cluster-samples-operator. The RBAC Role coreos-pull-secret-reader in namespa

CVE-2026-107161 - A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DI

CVE-2026-107313 - pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the

CVE-2026-107225 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 t

CVE-2026-107224 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 t

CVE-2026-107223 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 t

CVE-2026-107222 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 t

CVE-2026-107221 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 t

CVE-2026-107220 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 t

CVE-2026-107219 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t

CVE-2026-107218 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1

CVE-2026-107217 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 t

CVE-2026-106164 - In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, a

CVE-2026-103371 - Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affec

CVE-2026-96335 - Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured

CVE-2026-56851 - The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input int

CVE-2026-107216 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 t

CVE-2026-107215 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t

CVE-2026-107214 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t

CVE-2026-107213 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 t

CVE-2026-107212 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 t

CVE-2026-107211 - Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 t

CVE-2026-106067 - A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a

CVE-2026-106066 - A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large

CVE-2026-95606 - Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows

CVE-2026-95605 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-95595 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-95534 - Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Element

CVE-2026-94670 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94662 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-92543 - Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureR

CVE-2026-92542 - The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic V

CVE-2026-76501 - A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (

CVE-2026-76500 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Applicati

CVE-2026-76499 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Applicati

CVE-2026-76498 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Applicati

CVE-2026-76488 - A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Cont

CVE-2026-76486 - A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS

CVE-2026-76485 - A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS

CVE-2026-76484 - As part of Cisco's ongoing commitment to proactive security and product quality, the engineering tea

CVE-2026-76483 - As part of Cisco's ongoing commitment to proactive security and product quality, the engineering tea

CVE-2026-76482 - As part of Cisco's ongoing commitment to proactive security and product quality, the engineering tea

CVE-2026-76480 - As part of Cisco's ongoing commitment to proactive security and product quality, the engineering tea

CVE-2026-76472 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76471 - A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote

CVE-2026-76470 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76469 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76468 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76467 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76465 - A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS

CVE-2026-76464 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76463 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networkin

CVE-2026-76459 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76458 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76457 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76456 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76455 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76454 - A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Sm

CVE-2026-76453 - As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS eng

CVE-2026-76452 - A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart

CVE-2026-76437 - A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Softw

CVE-2026-62253 - Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware

CVE-2026-62252 - Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer

CVE-2026-62251 - Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQue

CVE-2026-62176 - PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the `deploy/api.py` module generat

CVE-2026-20362 - A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticate

CVE-2026-20328 - A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart

CVE-2026-20321 - A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controll

CVE-2026-20173 - A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote attacker to exhaust s

CVE-2026-20038 - A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexus 9000 Series Fabric

CVE-2026-20032 - A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, loca

CVE-2026-106557 - Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @back

CVE-2026-106065 - A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large

CVE-2026-101886 - Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability

CVE-2026-92415 - — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's

CVE-2026-92414 - : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit We

CVE-2026-33586 - Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields

CVE-2026-107278 - MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created w

CVE-2026-107276 - MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP

CVE-2026-107273 - Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authe

CVE-2026-107272 - Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow

CVE-2026-107271 - Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attack

CVE-2026-107270 - Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authen

CVE-2026-107269 - Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows

CVE-2026-107210 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-107209 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-107208 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-107207 - LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitorin

CVE-2026-107206 - LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP

CVE-2026-107205 - LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinato

CVE-2026-107204 - LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows re

CVE-2026-107166 - A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_p

CVE-2026-106580 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106579 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106578 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106577 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106576 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106575 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106574 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106573 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106572 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106571 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106570 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106569 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106568 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106567 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106566 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106565 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-106564 - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior

CVE-2026-77214 - libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_Par

CVE-2026-62179 - PraisonAI is a multi-agent teams system. In `praisonai-platform` prior to version 0.1.9, issue depen

CVE-2026-46570 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/in

CVE-2026-107202 - A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API

CVE-2026-107174 - A flaw was found in source-to-image. When unpacking archive files, the application fails to properly

CVE-2026-107169 - A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input t

CVE-2026-107167 - A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-a

CVE-2026-107125 - A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI

CVE-2026-106563 - Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugi

CVE-2026-106562 - Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-s

CVE-2026-106561 - Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugi

CVE-2026-106560 - Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugi

CVE-2026-106559 - Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugi

CVE-2026-106558 - Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, t

CVE-2026-106556 - Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi

CVE-2026-106510 - Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi

CVE-2026-106064 - A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very la

CVE-2026-104074 - Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthent

CVE-2025-70522 - The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin reso

CVE-2025-70521 - The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not hand

CVE-2025-70520 - The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authenticati

CVE-2025-70519 - The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc

CVE-2025-70518 - The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not hand

CVE-2025-70517 - The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin reso

CVE-2025-70516 - The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authenticati

CVE-2025-70515 - The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc

CVE-2026-88514 - An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

CVE-2026-46572 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.

CVE-2026-46571 - In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/repars

CVE-2026-46569 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/inde

CVE-2026-46438 - wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated atta

CVE-2026-46437 - wger is a free, open-source workout and fitness manager. Versions prior to 2.6 have a vulnerability

CVE-2026-46434 - wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the

CVE-2026-45161 - wger is a free, open-source workout and fitness manager. Prior to version 2.6, the `trainer_login` v

CVE-2026-43976 - wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management v

CVE-2026-42618 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that al

CVE-2026-42617 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows

CVE-2026-42616 - In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attac

CVE-2026-107194 - Sungrow iSolarCloud before 2026 allows authentication bypass and account takeover via "login_type":"

CVE-2026-107183 - llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_m

CVE-2026-107181 - Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sand

CVE-2026-102258 - Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA10

CVE-2026-102257 - A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows a

CVE-2026-98374 - In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retr

CVE-2026-98373 - In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap add

CVE-2026-42532 - A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (ver

CVE-2026-41958 - A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiD

CVE-2026-107180 - On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of t

CVE-2026-107177 - Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows att

CVE-2026-107175 - MISP contains a defect in its event save workflow that prevents the correlation engine from recalcul

CVE-2026-107170 - A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal

CVE-2026-107168 - A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character seque

CVE-2026-107162 - Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 ref

CVE-2026-107151 - Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow pa

CVE-2026-105140 - Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group

CVE-2026-105139 - Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated u

CVE-2026-105138 - Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows

CVE-2026-103435 - Claude Code validated that a target file path resided within the project working directory at permis

CVE-2026-102256 - Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command I

CVE-2026-102255 - A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to

CVE-2026-42710 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-42708 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-107159 - MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPD

CVE-2026-106059 - GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to

CVE-2026-106058 - GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that all

CVE-2026-106057 - patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt

CVE-2026-106056 - Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users

CVE-2026-96408 - A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unau

CVE-2026-92533 - Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to sp

CVE-2026-92532 - Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authentica

CVE-2026-92531 - Operating system command injection vulnerability in the SVN integration component of BugTracker.NET.

CVE-2026-42714 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-42713 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-103668 - An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow a

CVE-2026-97294 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-97146 - Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a se

CVE-2026-92393 - Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload U

CVE-2026-78243 - Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out o

CVE-2026-42721 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-42720 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-27434 - Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Inco

CVE-2026-105884 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105876 - Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows

CVE-2026-105875 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105873 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105871 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105192 - LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so w

CVE-2026-104393 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-104391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-104390 - Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Con

CVE-2026-103075 - Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly

CVE-2026-97720 - Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions u

CVE-2026-93684 - An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaS

CVE-2026-93026 - This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Man

CVE-2026-90466 - Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded

CVE-2026-89417 - The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to St

CVE-2026-5703 - Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the we

CVE-2026-58069 - This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to rea

CVE-2026-58068 - This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary