CVE-2026-80521 - In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in un

CVE-2026-80520 - In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when

CVE-2026-80519 - In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cl

CVE-2026-75062 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the defaul

CVE-2026-74754 - In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM

CVE-2026-74753 - In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as g

CVE-2026-74752 - In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH stat

CVE-2026-74751 - In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen rea

CVE-2026-74750 - In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto fre

CVE-2026-74749 - In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on gr

CVE-2026-74748 - In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount

CVE-2026-74747 - In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent

CVE-2026-74746 - In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish G

CVE-2026-74745 - In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when

CVE-2026-74744 - In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom

CVE-2026-74743 - In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroo

CVE-2026-74742 - In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to w

CVE-2026-74741 - In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer der

CVE-2026-74740 - In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix TOCTOU

CVE-2026-74739 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash t

CVE-2026-74738 - In the Linux kernel, the following vulnerability has been resolved: regmap: sdw-mbq: don't call an

CVE-2026-74737 - In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nu

CVE-2026-74736 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-

CVE-2026-74735 - In the Linux kernel, the following vulnerability has been resolved: l2tp: fix tunnel and session re

CVE-2026-74734 - In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: fix NULL pointe

CVE-2026-54556 - Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, an unauthenticated HT

CVE-2026-54553 - Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI a

CVE-2026-54550 - IzPack is a widely used tool for packaging applications on the Java platform as cross-platform insta

CVE-2026-54548 - kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SS

CVE-2026-54523 - Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1

CVE-2026-54511 - LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog p

CVE-2026-13481 - The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME

CVE-2026-13480 - The LoRaWAN TS004 Fragmented Data Block Transport handler frag_transport_package_callback() in subsy

CVE-2026-13479 - The LoRaWAN application-layer clock-synchronization service parses downlinks in clock_sync_package_c

CVE-2026-7487 - GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 bef

CVE-2026-79902 - A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW im

CVE-2026-77801 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2

CVE-2026-75960 - Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credential

CVE-2026-75896 - Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institu

CVE-2026-73108 - RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability i

CVE-2026-73102 - RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard

CVE-2026-3035 - GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 bef

CVE-2026-19271 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i

CVE-2026-18252 - GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 bef

CVE-2026-15990 - The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up t

CVE-2026-15387 - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 bef

CVE-2026-12717 - An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery

CVE-2025-10903 - GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 be

CVE-2026-79619 - On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-cre

CVE-2026-77658 - A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network

CVE-2026-12587 - The vulnerability allows the unauthorised generation of physical access QR codes due to the use of h

CVE-2026-63041 - Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerabil

CVE-2026-15985 - The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentica

CVE-2026-80206 - NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgre

CVE-2026-80205 - NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.fin

CVE-2026-80204 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 does not apply the API-key scope cap in

CVE-2026-80203 - The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSup

CVE-2026-77557 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability

CVE-2026-77554 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77553 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-77552 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77551 - A malicious actor with access to the network and under certain conditions could exploit an Improper

CVE-2026-77550 - A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequen

CVE-2026-77549 - A malicious actor with access to the network and under certain conditions could exploit an Improper

CVE-2026-77548 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77547 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77546 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77532 - A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability f

CVE-2026-5092 - The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cros

CVE-2026-3235 - The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver

CVE-2026-18080 - The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl

CVE-2026-80350 - OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a sma

CVE-2026-80349 - TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header

CVE-2026-80348 - TarsWeb enforces its per-application roles by calling AuthService from individual controller methods

CVE-2026-80347 - mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround a

CVE-2026-80346 - StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every

CVE-2026-77545 - A malicious actor with access to the network, low privileges and under certain conditions could expl

CVE-2026-77543 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-77542 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77541 - A malicious actor with access to the network and high privileges could exploit an Improper Access Co

CVE-2026-77540 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77539 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77538 - A malicious actor with access to the network could exploit an Improper Access Control vulnerability

CVE-2026-77537 - A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit

CVE-2026-77536 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-77535 - A malicious actor with access to the network and high privileges could exploit an Improper Input Val

CVE-2026-77534 - A malicious actor with access to the network and low privileges could exploit an Improper Access Con

CVE-2026-59683 - The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system

CVE-2026-59682 - Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0

CVE-2026-2388 - The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-19042 - A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.8

CVE-2026-18794 - The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory re

CVE-2026-16444 - Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.8

CVE-2026-80237 - EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authent

CVE-2026-80236 - Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated

CVE-2026-80235 - EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthe

CVE-2026-80234 - CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. U

CVE-2026-80233 - CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File U

CVE-2026-77533 - A malicious actor with access to the network and low privileges could exploit an Improper Input Vali

CVE-2026-19538 - The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol po

CVE-2026-19401 - Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a spe

CVE-2026-19197 - A user with organization administrator permissions can delete dashboard snapshots belonging to other

CVE-2026-18916 - Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP quer

CVE-2026-18664 - When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly com

CVE-2026-9668 - With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass

CVE-2026-78237 - Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into t

CVE-2026-78236 - An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a

CVE-2026-75977 - The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Coo

CVE-2026-6178 - The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_b

CVE-2026-18884 - The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby'

CVE-2026-58108 - The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of

CVE-2026-3002 - The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable

CVE-2026-18431 - The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and inclu

CVE-2026-18331 - The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin

CVE-2026-15366 - A control logic defect in a specific built-in webpage of Kids Mode allows users to view local galler

CVE-2026-15365 - A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification a

CVE-2026-79654 - A flaw was found in Katello where the Content View History API does not properly enforce authorizati

CVE-2026-78146 - The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is th

CVE-2026-77790 - The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter befo

CVE-2026-77789 - The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscr

CVE-2026-77758 - The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that

CVE-2026-77757 - The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.

CVE-2026-77754 - The Kirki WordPress plugin before 6.0.14 does not perform a capability check on some endpoints of o

CVE-2026-77695 - The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly veri

CVE-2026-77694 - The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkou

CVE-2026-77693 - The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the use

CVE-2026-75798 - The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its a

CVE-2026-75797 - The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it

CVE-2026-74930 - The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is be

CVE-2026-74929 - The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes

CVE-2026-74928 - The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its impo

CVE-2026-74851 - The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its

CVE-2026-58097 - mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buff

CVE-2026-58096 - LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the

CVE-2026-58095 - mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for

CVE-2026-58094 - The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object.

CVE-2026-58093 - The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After rea

CVE-2026-19760 - The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Sit

CVE-2026-19718 - The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin Word

CVE-2026-19226 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget setti

CVE-2026-19220 - The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabl

CVE-2026-19094 - The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query

CVE-2026-16986 - The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side

CVE-2026-16984 - The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates

CVE-2026-15203 - Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine

CVE-2026-14550 - The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a r

CVE-2026-14216 - The Booking for Appointments and Events Calendar WordPress plugin before 2.4.7 does not require aut

CVE-2026-14212 - The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that a

CVE-2026-13406 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or

CVE-2026-13404 - The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or

CVE-2026-13172 - The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by sta

CVE-2026-9805 - SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without

CVE-2026-9252 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9250 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-9146 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-80216 - Rejected reason: duplicate record

CVE-2026-80214 - LibreNMS’s Virtualization Discovery module is vulnerable to command line injection. An authenticated

CVE-2026-80202 - Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), wh

CVE-2026-80201 - Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allo

CVE-2026-80200 - Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handl

CVE-2026-80199 - Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthe

CVE-2026-80198 - Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and ex

CVE-2026-80197 - Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add a

CVE-2026-80196 - Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remai

CVE-2026-80195 - Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team upd

CVE-2026-80194 - Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController expo

CVE-2026-80193 - Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller

CVE-2026-80192 - @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7

CVE-2026-80191 - GROWI applies its page-viewer permission check to attachment requests only when the request carries

CVE-2026-80189 - LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor

CVE-2026-76149 - CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written t

CVE-2026-76148 - CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the

CVE-2026-73335 - Android application "Myna Point" is vulnerable to Improper Authorization in Handler for Custom URL S

CVE-2026-58092 - In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the pri

CVE-2026-58091 - The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If lock

CVE-2026-58090 - The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messag

CVE-2026-58089 - When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach P

CVE-2026-57171 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc

CVE-2026-57170 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc

CVE-2026-54467 - On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on

CVE-2026-52776 - Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions befo

CVE-2026-29988 - A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Mil

CVE-2026-19632 - The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner

CVE-2026-80138 - ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter be

CVE-2026-79912 - A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the f

CVE-2026-79911 - A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected el

CVE-2026-70665 - Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails application

CVE-2026-55805 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-54757 - Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc

CVE-2026-44476 - Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a

CVE-2026-41707 - Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Securi

CVE-2026-18985 - Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This i

CVE-2026-18261 - Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.

CVE-2026-18260 - Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page

CVE-2026-18259 - Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This

CVE-2026-16646 - Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

CVE-2026-16645 - Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery

CVE-2026-16644 - Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue af

CVE-2026-16643 - Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.

CVE-2026-16642 - Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.

CVE-2026-16641 - Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.

CVE-2026-16640 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-16639 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalizatio

CVE-2026-16638 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-15917 - Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i

CVE-2026-15916 - Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affec

CVE-2026-15088 - Vulnerability in Drupal Development Environment. This issue affects Development Environment versions

CVE-2026-80186 - A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A r

CVE-2026-80185 - BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS):

CVE-2026-80184 - In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1

CVE-2026-80182 - In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential

CVE-2026-79845 - A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affe

CVE-2026-79804 - A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea594

CVE-2026-78655 - Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset b

CVE-2026-78619 - Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-f

CVE-2026-73180 - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an a

CVE-2026-68763 - Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/

CVE-2026-68569 - Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT

CVE-2026-68525 - Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypa

CVE-2026-66422 - Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being i

CVE-2026-65927 - Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes

CVE-2026-65905 - Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, b

CVE-2026-65637 - Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.

CVE-2026-65183 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix

CVE-2026-65182 - Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security co

CVE-2026-63404 - Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the embedded Redi

CVE-2026-63403 - Faktory is a language-agnostic background job server. In versions prior to 1.10.0, the server is vul

CVE-2026-62865 - Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side

CVE-2026-62862 - Typebot is an open-source chatbot builder. In self-hosted versions up to and including 3.17.1, the d

CVE-2026-62861 - TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can

CVE-2026-38474 - GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken

CVE-2026-38473 - A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c

CVE-2026-38472 - A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf

CVE-2026-38470 - A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) comm

CVE-2026-38469 - A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit

CVE-2026-38468 - A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) c

CVE-2026-38467 - A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf72

CVE-2026-38466 - A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterW

CVE-2026-38465 - A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWa

CVE-2026-32637 - Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources

CVE-2026-80104 - DB-GPT builds the destination path for an uploaded skill from the multipart filename without constra

CVE-2026-80101 - A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file,

CVE-2026-79793 - A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnera

CVE-2026-79792 - A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_dow

CVE-2026-79293 - Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to o

CVE-2026-79292 - Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who

CVE-2026-79291 - Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain

CVE-2026-79290 - Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute

CVE-2026-79289 - Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.

CVE-2026-79288 - Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed