CVE-2026-66651 - Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows

CVE-2026-66646 - Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

CVE-2026-66645 - Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVE-2026-66644 - Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

CVE-2026-66643 - Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVE-2026-66641 - Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

CVE-2026-66640 - Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVE-2026-66639 - Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4

CVE-2026-66638 - Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

CVE-2026-66637 - Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

CVE-2026-66636 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-66635 - Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site

CVE-2026-66634 - Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

CVE-2026-66633 - Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVE-2026-66629 - Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

CVE-2026-66627 - Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allo

CVE-2026-66622 - Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

CVE-2026-66621 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-66620 - Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

CVE-2026-66046 - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic compl

CVE-2026-63639 - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey

CVE-2026-63632 - Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From

CVE-2026-61407 - Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Acce

CVE-2026-59949 - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementation

CVE-2026-59940 - Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap

CVE-2026-59825 - Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from

CVE-2026-56684 - Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey

CVE-2026-50187 - Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the d

CVE-2026-50139 - goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share to

CVE-2026-50138 - goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web

CVE-2026-48798 - SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string

CVE-2026-45733 - Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe

CVE-2026-32553 - Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

CVE-2026-32549 - Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

CVE-2026-32547 - Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

CVE-2026-32481 - Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

CVE-2026-32474 - Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

CVE-2026-32473 - Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versio

CVE-2026-32472 - Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

CVE-2026-32470 - Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

CVE-2026-18534 - ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated

CVE-2026-73692 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-50575 - BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly inv

CVE-2026-32468 - Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

CVE-2026-32467 - Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

CVE-2026-32466 - Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

CVE-2026-32465 - Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

CVE-2026-32464 - Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

CVE-2026-32463 - Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

CVE-2026-32444 - Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

CVE-2026-32333 - Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

CVE-2026-28571 - Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

CVE-2026-28570 - Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

CVE-2026-28569 - Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

CVE-2026-28568 - Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

CVE-2026-28567 - Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

CVE-2026-28192 - Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

CVE-2026-28191 - Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This

CVE-2026-24301 - Improper neutralization of special elements used in a command ('command injection') in Microsoft Cop

CVE-2026-17084 - The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the la

CVE-2026-75874 - Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154,

CVE-2026-75783 - A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulner

CVE-2026-75778 - A vulnerability was identified in code-projects Task Management System 1.0. This affects the functio

CVE-2026-74990 - Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

CVE-2026-74989 - Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corru

CVE-2026-74988 - Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showe

CVE-2026-74987 - Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

CVE-2026-74986 - Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in F

CVE-2026-74985 - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 1

CVE-2026-74984 - Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Fire

CVE-2026-74983 - Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154

CVE-2026-74982 - Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR

CVE-2026-74981 - Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firef

CVE-2026-74980 - Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed i

CVE-2026-74979 - Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Fir

CVE-2026-74978 - Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR

CVE-2026-74977 - Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR

CVE-2026-74976 - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox

CVE-2026-74975 - Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Fi

CVE-2026-74974 - Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firef

CVE-2026-74973 - Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 15

CVE-2026-74972 - Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Fir

CVE-2026-74971 - Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixe

CVE-2026-74970 - Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox

CVE-2026-74969 - Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154,

CVE-2026-74968 - Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1

CVE-2026-74967 - Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Fi

CVE-2026-74966 - Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154,

CVE-2026-74965 - Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154

CVE-2026-74964 - Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR

CVE-2026-74963 - Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Fire

CVE-2026-74962 - Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 1

CVE-2026-74961 - Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 15

CVE-2026-74960 - Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Fi

CVE-2026-74959 - Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154,

CVE-2026-74958 - Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox

CVE-2026-74957 - Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firef

CVE-2026-74956 - Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Fir

CVE-2026-74955 - Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154,

CVE-2026-74954 - Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability w

CVE-2026-74953 - Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 1

CVE-2026-74952 - Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15

CVE-2026-74951 - Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154.

CVE-2026-74950 - Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Fi

CVE-2026-74949 - Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability w

CVE-2026-74948 - Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firef

CVE-2026-74947 - Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed

CVE-2026-74946 - Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th

CVE-2026-74945 - Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154,

CVE-2026-74944 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firef

CVE-2026-74943 - Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Fir

CVE-2026-74942 - Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefo

CVE-2026-74941 - Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox

CVE-2026-74940 - Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox

CVE-2026-74939 - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154,

CVE-2026-74938 - Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Fire

CVE-2026-74937 - Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox

CVE-2026-74936 - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154

CVE-2026-74935 - Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154,

CVE-2026-74934 - Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox

CVE-2026-59781 - When Zabbix Agent was installed on Windows into a custom installation directory, the installer did n

CVE-2026-45532 - DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a pa

CVE-2026-23938 - An authenticated administrator is able to crash Zabbix server or proxy by creating specifically craf

CVE-2026-23937 - The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key l

CVE-2026-23935 - A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/prepr

CVE-2026-23934 - An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sendin

CVE-2026-23933 - In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written

CVE-2026-23931 - The frontend validatate.api.exists action can be exploited by authenticated users to extract plainte

CVE-2026-23930 - An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by send

CVE-2026-23929 - Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps.

CVE-2026-23922 - The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak

CVE-2026-1199 - Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests

CVE-2026-18751 - External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue af

CVE-2026-16309 - Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies E

CVE-2026-75855 - ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint'

CVE-2026-75854 - ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-pro

CVE-2026-75853 - ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforc

CVE-2026-75852 - ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB

CVE-2026-75851 - ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the

CVE-2026-75850 - ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and t

CVE-2026-75846 - ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability

CVE-2026-75845 - ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_ser

CVE-2026-75844 - ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DA

CVE-2026-75843 - ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor th

CVE-2026-75842 - ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD

CVE-2026-75841 - ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function tha

CVE-2026-75840 - ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandb

CVE-2026-75839 - ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object referen

CVE-2026-75838 - DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where

CVE-2026-75837 - Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required sec

CVE-2026-75836 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.1

CVE-2026-75835 - Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerabili

CVE-2026-75834 - Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss()

CVE-2026-75833 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before v

CVE-2026-75832 - The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in

CVE-2026-75831 - Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media

CVE-2026-75830 - grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra

CVE-2026-75829 - grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, al

CVE-2026-75828 - Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function

CVE-2026-75827 - Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare

CVE-2026-75774 - A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unk

CVE-2026-75107 - Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append

CVE-2026-74908 - Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only

CVE-2026-74907 - Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.p

CVE-2026-74906 - SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-

CVE-2026-74905 - SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP

CVE-2026-74904 - SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kerne

CVE-2026-74903 - SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBloc

CVE-2026-74902 - SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flo

CVE-2026-5224 - Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technolog

CVE-2026-15585 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN

CVE-2026-75773 - A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the functio

CVE-2026-75627 - Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut

CVE-2026-75626 - SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s

CVE-2026-19608 - A flaw was found in the group policy provider of Keycloak authorization services, which is used to m

CVE-2026-19447 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2024-14046 - A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function

CVE-2026-18929 - Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processi

CVE-2026-43971 - Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directi

CVE-2024-14045 - A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of

CVE-2026-34884 - SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking

CVE-2026-15371 - Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the

CVE-2026-75091 - The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera

CVE-2026-15748 - The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up

CVE-2026-75151 - A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0.

CVE-2026-11801 - The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all

CVE-2026-75094 - A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /

CVE-2026-75093 - A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Te

CVE-2026-75090 - A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the

CVE-2026-75089 - A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue

CVE-2026-75088 - A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unkno

CVE-2026-75087 - A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown fu

CVE-2026-75086 - A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element

CVE-2026-75082 - A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of

CVE-2026-75081 - A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the f

CVE-2026-75080 - A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.

CVE-2026-75079 - A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnera

CVE-2026-9693 - Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membersh

CVE-2026-75587 - Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a d

CVE-2026-75078 - A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This af

CVE-2026-67961 - An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mech

CVE-2026-67919 - An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.ja

CVE-2026-42164 - Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call

CVE-2026-42162 - Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certai

CVE-2026-38165 - A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration

CVE-2026-9859 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce Permissi

CVE-2026-9816 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMe

CVE-2026-75077 - A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by

CVE-2026-71424 - Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers

CVE-2026-69148 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-69146 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-67960 - An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.

CVE-2026-67918 - Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensi

CVE-2026-67868 - A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter hand

CVE-2026-67854 - SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

CVE-2026-65351 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65349 - An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.

CVE-2026-65347 - The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, m

CVE-2026-65346 - An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1

CVE-2026-65343 - A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.

CVE-2026-65341 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.

CVE-2026-65340 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65339 - A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.

CVE-2026-65338 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.6.1, iOS 18.

CVE-2026-65337 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65336 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65335 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65334 - A memory corruption issue was addressed with improved state management. This issue is fixed in Safar

CVE-2026-65333 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65332 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65331 - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iO

CVE-2026-65330 - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS

CVE-2026-65329 - An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.

CVE-2026-64849 - MLflow is an open source AI engineering platform for agents, large language models, and machine lear

CVE-2026-64788 - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6.1 and iPadOS

CVE-2026-64787 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-64784 - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Sa

CVE-2026-64782 - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari

CVE-2026-64781 - The issue was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 18

CVE-2026-64780 - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and

CVE-2026-64779 - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari

CVE-2026-64778 - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and

CVE-2026-64760 - An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10

CVE-2026-64715 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-63178 - Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/us

CVE-2026-56677 - 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint i

CVE-2026-54385 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-51977 - An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically

CVE-2026-45791 - Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.updat

CVE-2026-45790 - Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's organizati