CVE-2026-75110 - MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is en

CVE-2026-75109 - Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the

CVE-2026-75108 - Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN end

CVE-2026-75106 - OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an em

CVE-2026-75105 - phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary

CVE-2026-75104 - Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing atta

CVE-2026-75103 - Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allow

CVE-2026-73560 - vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMu

CVE-2026-73410 - Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo

CVE-2026-71518 - Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download rou

CVE-2026-68765 - hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePas

CVE-2026-67967 - Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute arbitrary

CVE-2026-67966 - Tenda W20E V16.01.0.6(2782) /goform/telnet endpoint allows unauthenticated remote attackers to activ

CVE-2026-67965 - An issue in Tneda W20E v.16.01.0.6(2782) allows a remote attacker to execute arbitrary code via the

CVE-2026-67926 - An issue in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the files Param

CVE-2026-67925 - Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrar

CVE-2026-67917 - zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup res

CVE-2026-66795 - A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto

CVE-2026-65976 - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.300, a conne

CVE-2026-65974 - ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0,

CVE-2026-65832 - Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthe

CVE-2026-65822 - ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0,

CVE-2026-65640 - WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file uploa

CVE-2026-64657 - Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector

CVE-2026-63409 - Deskflow is a keyboard and mouse sharing app. From 1.17.0 until continuous build 1.26.0.296, a malic

CVE-2026-54356 - Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/u

CVE-2026-54336 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Fr

CVE-2026-47698 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.j

CVE-2026-47686 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbo

CVE-2026-47683 - vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in l

CVE-2026-44846 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr

CVE-2026-44845 - JumpServer is an open source bastion host and an operation and maintenance security audit system. Pr

CVE-2026-40506 - OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php inter

CVE-2026-39255 - Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execut

CVE-2026-39254 - Buffer Overflow vulnerability in SteelSeries GG (macOS) v.107.0.0 allows a remote attacker to execut

CVE-2026-35219 - Budibase is an open-source low-code platform. Prior to 3.41.3, automation steps in packages/server/s

CVE-2026-34789 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/Prope

CVE-2026-34399 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCA

CVE-2026-34398 - FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mo

CVE-2026-19589 - Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow uni

CVE-2026-75014 - A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability aff

CVE-2026-75013 - A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function se

CVE-2026-75012 - A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by th

CVE-2026-74234 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-71858 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attack

CVE-2026-71553 - ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api

CVE-2026-71486 - vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completi

CVE-2026-71472 - A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such a

CVE-2026-70495 - A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad pe

CVE-2026-68005 - An issue in ACME mini_httpd 1.30 and prior allows a remote attacker to cause a denial of service via

CVE-2026-68004 - An issue in OSSRS SRS (Simple Realtime Server) <v5.0.213 allows a remote attacker to execute arbitra

CVE-2026-67678 - File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute ar

CVE-2026-63670 - ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() c

CVE-2026-63669 - ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module'

CVE-2026-63667 - ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export

CVE-2026-57485 - Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P

CVE-2026-57233 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress functi

CVE-2026-54758 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs

CVE-2026-52886 - Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the back

CVE-2026-19650 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.

CVE-2026-19478 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.

CVE-2026-75011 - A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the fil

CVE-2026-74238 - TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpac

CVE-2026-71693 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-66792 - A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a use

CVE-2026-60107 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-60106 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-50776 - Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote atta

CVE-2026-50775 - A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the

CVE-2026-50774 - An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Ma

CVE-2026-50773 - An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to ex

CVE-2026-45698 - Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.

CVE-2026-17639 - Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condi

CVE-2026-12553 - HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticat

CVE-2026-74254 - Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Pag

CVE-2026-74253 - Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in

CVE-2026-73523 - COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c tha

CVE-2026-73522 - COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthentic

CVE-2026-73424 - Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel ada

CVE-2026-71980 - Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the d

CVE-2026-71979 - INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f,

CVE-2026-71491 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlpars

CVE-2026-68520 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in

CVE-2026-68519 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run(

CVE-2026-62982 - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_m

CVE-2026-59903 - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2

CVE-2026-59902 - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2

CVE-2026-59894 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.p

CVE-2026-59893 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key

CVE-2026-54284 - sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction an

CVE-2026-51346 - SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote att

CVE-2026-50772 - An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via

CVE-2026-50771 - Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to

CVE-2026-50770 - An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges

CVE-2026-50769 - The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Inj

CVE-2026-50768 - File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a r

CVE-2026-48053 - Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoin

CVE-2026-46345 - compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a

CVE-2026-33437 - Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P

CVE-2026-9771 - The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On bu

CVE-2026-68518 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_

CVE-2026-68517 - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins gu

CVE-2026-61666 - websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driv

CVE-2026-40145 - A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deploymen

CVE-2026-12630 - Zephyr's 6LoWPAN IP Header Compression (IPHC) uncompression code contains an out-of-bounds read in g

CVE-2026-12629 - The ARM PL011 UART driver in drivers/serial/uart_pl011.c fails to acknowledge receive error interrup

CVE-2026-12519 - The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on_cmd_socknotifyev()

CVE-2026-75060 - In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP too

CVE-2026-75059 - In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible

CVE-2026-75058 - In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

CVE-2026-75057 - In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

CVE-2026-75056 - In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

CVE-2026-75055 - In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

CVE-2026-75054 - In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrus

CVE-2026-75053 - In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

CVE-2026-75052 - In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content wa

CVE-2026-75051 - In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was po

CVE-2026-75050 - In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type pa

CVE-2026-75049 - In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted

CVE-2026-75048 - In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was po

CVE-2026-75047 - In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the im

CVE-2026-75046 - In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the use

CVE-2026-75045 - In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker

CVE-2026-75044 - In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allow

CVE-2026-74858 - A vulnerability has been found in jae-jae fetcher-mcp up to 0.3.9. Impacted is the function fetch_ur

CVE-2026-73646 - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rul

CVE-2026-71479 - New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys

CVE-2026-68762 - In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible

CVE-2026-64868 - New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys

CVE-2026-64866 - New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys

CVE-2026-64865 - New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys

CVE-2026-64859 - New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys

CVE-2026-59829 - Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1

CVE-2026-55704 - Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0,

CVE-2026-55674 - Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0

CVE-2026-53960 - Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0

CVE-2026-40144 - A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privileg

CVE-2025-27772 - UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.

CVE-2025-27771 - UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.

CVE-2025-27770 - UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.

CVE-2025-27621 - UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.

CVE-2026-73851 - Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who co

CVE-2026-71567 - In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variable

CVE-2026-71566 - FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware

CVE-2026-16049 - Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify c

CVE-2026-16048 - Mattermost versions 11.8.x <= 11.8.2, 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to restrict channel

CVE-2026-16047 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that us

CVE-2026-16046 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on wr

CVE-2026-16045 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 Mattermost failed to restrict OAuth deauth

CVE-2026-16044 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving

CVE-2026-15754 - Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint f

CVE-2026-13202 - A vulnerability in OpenText Opentext Directory Services allows Input Data Manipulation. This issue

CVE-2026-10527 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile Schem

CVE-2026-59911 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into L

CVE-2026-59910 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen

CVE-2026-59909 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privil

CVE-2026-56686 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen

CVE-2026-56685 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen

CVE-2026-56090 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerab

CVE-2026-56089 - Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privil

CVE-2026-19693 - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and nev

CVE-2026-16471 - Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Fun

CVE-2026-16139 - In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zon

CVE-2026-16138 - In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of

CVE-2026-16137 - In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential

CVE-2026-15218 - A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. Th

CVE-2026-75010 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin

CVE-2026-75007 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to inj

CVE-2026-75006 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS)

CVE-2026-75004 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to

CVE-2026-75003 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute

CVE-2026-75002 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desyn

CVE-2026-75000 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG

CVE-2026-74999 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subj

CVE-2026-74998 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style S

CVE-2026-74997 - In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk pl

CVE-2026-70412 - Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a

CVE-2026-18674 - On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attribu

CVE-2026-16467 - Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing F

CVE-2026-14564 - Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consul

CVE-2026-74843 - A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerabilit

CVE-2026-40126 - OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be

CVE-2026-74901 - openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where

CVE-2026-74900 - openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsula

CVE-2026-74899 - openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecut

CVE-2026-74896 - openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPattern

CVE-2026-74895 - openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isol

CVE-2026-74894 - openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token

CVE-2026-74893 - openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py tha

CVE-2026-74892 - openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telem

CVE-2026-74891 - openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server co

CVE-2026-74890 - openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCiph

CVE-2026-74889 - openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normali

CVE-2026-74888 - openssl_encrypt versions before 1.4.0 use a non-standard PBKDF2 key derivation construction with ite

CVE-2026-74887 - openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PR

CVE-2026-74886 - openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the Plugin

CVE-2026-74885 - openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs mo

CVE-2026-74884 - openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path me

CVE-2026-74883 - openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbo

CVE-2026-74882 - openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the enti

CVE-2026-74881 - openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_cr

CVE-2026-74880 - openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and

CVE-2026-74879 - openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready

CVE-2026-74878 - openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection

CVE-2026-74877 - openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the

CVE-2026-74876 - openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that cr

CVE-2026-74875 - openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema libra

CVE-2026-74874 - openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographi

CVE-2026-74873 - openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in pro

CVE-2026-74872 - openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirl

CVE-2026-74871 - openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mo

CVE-2026-74870 - openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm

CVE-2026-74869 - stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message hand

CVE-2026-74868 - SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service

CVE-2026-74867 - SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cooki

CVE-2026-74842 - A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452.

CVE-2026-74802 - SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-onl

CVE-2026-74801 - SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-lin

CVE-2026-74800 - SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when servin

CVE-2026-74799 - SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps w

CVE-2026-74798 - SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool.

CVE-2026-74845 - Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner

CVE-2026-58561 - Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vu

CVE-2026-58560 - Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vu

CVE-2026-49308 - Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vu

CVE-2026-49307 - Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of

CVE-2026-49306 - UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerab

CVE-2026-49305 - Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of

CVE-2026-49304 - Permission control vulnerability in the device key management module. Impact: Successful exploitatio

CVE-2026-49303 - Permission control vulnerability in the notification module. Impact: Successful exploitation of this

CVE-2026-49302 - Permission control vulnerability in the notification service module. Impact: Successful exploitation

CVE-2026-49301 - Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vuln

CVE-2026-20000 - A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is

CVE-2026-19999 - A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The a

CVE-2026-19998 - A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown f

CVE-2026-22072 - Loading arbitrary external URLs through WebView components introduces malicious JS code that can ste

CVE-2026-19997 - A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown p

CVE-2026-19996 - A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown cod

CVE-2026-19995 - A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the fi

CVE-2026-19994 - A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown func

CVE-2026-15623 - A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chroni

CVE-2026-74579 - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: fix mas

CVE-2026-19993 - A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an u

CVE-2026-19992 - A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up

CVE-2026-19988 - A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the f

CVE-2026-19987 - A security vulnerability has been detected in SourceCodester Best Employee Management System 1.0. Th

CVE-2026-14832 - The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorizat

CVE-2026-13700 - The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a s

CVE-2026-19986 - A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted

CVE-2026-19984 - A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the functio