CVE-2026-109624 - Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerabilit

CVE-2026-109623 - Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerabilit

CVE-2026-109622 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerabilit

CVE-2026-109621 - Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoi

CVE-2026-109617 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerabilit

CVE-2026-109616 - Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerabilit

CVE-2026-109615 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerabilit

CVE-2026-109614 - Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticat

CVE-2026-109613 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerabilit

CVE-2026-109612 - Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulner

CVE-2026-109611 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerabilit

CVE-2026-109610 - Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerabilit

CVE-2026-109609 - Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in so

CVE-2026-109608 - Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in se

CVE-2026-109604 - Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulner

CVE-2026-109603 - Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library

CVE-2026-109602 - Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability

CVE-2026-109601 - Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerabili

CVE-2026-109600 - Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is di

CVE-2026-109599 - Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in whi

CVE-2026-109598 - Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerabil

CVE-2026-109597 - Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnerability that allows M

CVE-2026-109596 - Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerability that lets mali

CVE-2026-109595 - Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious them

CVE-2026-109574 - Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious theme

CVE-2026-109573 - phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes s

CVE-2026-109572 - Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal pr

CVE-2026-108938 - A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown proce

CVE-2026-108937 - A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerabili

CVE-2026-108936 - A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of

CVE-2026-108935 - A weakness has been identified in Edimax BR-6208AC 1.32. Affected by this issue is some unknown func

CVE-2026-102627 - IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to

CVE-2025-71432 - Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vuln

CVE-2025-71431 - Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certa

CVE-2025-71430 - Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability

CVE-2024-58391 - Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printv

CVE-2024-58390 - Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerabilit

CVE-2023-54412 - Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in E

CVE-2023-54411 - Frappe framework before 13.32.0 uses weak authentication for print view access, because the print vi

CVE-2023-54410 - Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated use

CVE-2023-54409 - Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because

CVE-2023-54408 - Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by wea

CVE-2023-54407 - Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with e

CVE-2023-54406 - Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_

CVE-2026-92876 - IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker t

CVE-2026-90921 - IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service du

CVE-2026-90920 - IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due t

CVE-2026-90912 - IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of servi

CVE-2026-90911 - IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service du

CVE-2026-84312 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the co

CVE-2026-54459 - FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio

CVE-2026-53922 - odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and

CVE-2026-49484 - Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the

CVE-2026-49483 - Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the I

CVE-2026-44828 - Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/ini

CVE-2026-41210 - Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and

CVE-2026-108934 - A security flaw has been discovered in Edimax BR-6208AC 1.32. Affected by this vulnerability is an u

CVE-2026-108933 - A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file

CVE-2026-108932 - A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the fi

CVE-2026-104140 - QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.

CVE-2026-103658 - GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow wr

CVE-2026-102596 - Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.

CVE-2026-102539 - Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabil

CVE-2026-97691 - Convex is an open-source reactive database for application developers. Prior to the self-hosted imag

CVE-2026-96266 - IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmwa

CVE-2026-96265 - IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service

CVE-2026-96264 - IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the servic

CVE-2026-96263 - IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 t

CVE-2026-96262 - IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service

CVE-2026-96261 - IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmwa

CVE-2026-92120 - OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: th

CVE-2026-92119 - REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: throug

CVE-2026-92116 - OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: thro

CVE-2026-84360 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mu

CVE-2026-84321 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken create

CVE-2026-84320 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an aut

CVE-2026-84319 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configur

CVE-2026-84318 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool

CVE-2026-84317 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validatio

CVE-2026-84316 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDire

CVE-2026-84315 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply R

CVE-2026-84314 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id u

CVE-2026-84313 - Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and

CVE-2026-78673 - IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service du

CVE-2026-75881 - IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker t

CVE-2026-58462 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-53997 - Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authenticatio

CVE-2026-41508 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 unt

CVE-2026-41504 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-18537 - IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t

CVE-2026-18533 - IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t

CVE-2026-18529 - IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t

CVE-2026-18517 - IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 IBM Maximo Appl

CVE-2026-18513 - IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t

CVE-2026-16678 - IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 t

CVE-2026-109571 - Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability

CVE-2026-109570 - Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability

CVE-2026-109569 - sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container w

CVE-2026-109568 - Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Ches

CVE-2026-109567 - Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the

CVE-2026-109566 - Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows rem

CVE-2026-109565 - Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vulnerability that allow

CVE-2026-109564 - LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{

CVE-2026-109563 - N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer num

CVE-2026-109562 - SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authe

CVE-2026-109561 - goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to

CVE-2026-109560 - Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allow

CVE-2026-109559 - EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers l

CVE-2026-109558 - EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane

CVE-2026-109557 - EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview

CVE-2026-109556 - EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the deskto

CVE-2026-109427 - Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allow

CVE-2026-109426 - Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with

CVE-2026-109380 - modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to p

CVE-2026-109379 - Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticat

CVE-2026-109378 - SPIP before 4.4.18 contains a server-side request forgery vulnerability in recuperer_url() in ecrire

CVE-2026-109377 - ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticat

CVE-2026-109376 - ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timeshe

CVE-2026-109375 - Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLoc

CVE-2026-108931 - A vulnerability was found in Netcore NR268 1.7.121109. This affects the function eval of the file dh

CVE-2026-108930 - A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddn

CVE-2026-108929 - A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of th

CVE-2026-108928 - A security vulnerability has been detected in itsourcecode Online Admission System 1.0. This issue a

CVE-2026-108927 - A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulne

CVE-2026-106495 - Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backe

CVE-2026-105052 - IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse

CVE-2025-71429 - GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py

CVE-2024-58389 - HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that

CVE-2022-51020 - Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies

CVE-2021-48012 - fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify

CVE-2021-48011 - Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remot

CVE-2020-37280 - cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts decl

CVE-2020-37279 - easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attack

CVE-2026-96012 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attac

CVE-2026-95838 - containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, container

CVE-2026-95837 - containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI C

CVE-2026-41510 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-109575 - In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Serve

CVE-2026-109425 - Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.

CVE-2026-109424 - NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a

CVE-2026-109423 - NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a

CVE-2026-109422 - NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a

CVE-2026-108926 - A security flaw has been discovered in itsourcecode Baptism Information Management System 1.0. This

CVE-2026-108924 - A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the fu

CVE-2026-108923 - A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability

CVE-2026-108362 - Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS

CVE-2026-108361 - Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS

CVE-2026-104774 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-104364 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a den

CVE-2026-104332 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when e

CVE-2025-27902 - IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted referenc

CVE-2025-27897 - IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting.

CVE-2025-27896 - IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting.

CVE-2025-27895 - IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting.

CVE-2021-48009 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-89140 - Temporal Server does not bind internal completion callbacks to the namespace that attached them, whi

CVE-2026-87744 - A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers t

CVE-2026-85471 - A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blackl

CVE-2026-83536 - A flaw was found in openstack-network-exporter. The HTTP server within the component is configured w

CVE-2026-83535 - A flaw was found in openstack-network-exporter. When an operator configures user authentication but

CVE-2026-78404 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a local privilege escalati

CVE-2026-65954 - PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. From 1.0.0-alpha1 until 1.2

CVE-2026-59977 - ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/{id} endpoint uses H

CVE-2026-59976 - ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses t

CVE-2026-57143 - PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62, searxng_search and the sea

CVE-2026-57118 - PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the A

CVE-2026-18166 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 C

CVE-2026-108922 - A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000

CVE-2026-108921 - A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384

CVE-2026-108920 - A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This af

CVE-2026-108919 - A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted elemen

CVE-2026-107226 - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async

CVE-2026-105466 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when i

CVE-2026-105465 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when

CVE-2026-105464 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 C

CVE-2026-104355 - A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never re

CVE-2026-104102 - copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine des

CVE-2026-103061 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in glea

CVE-2026-102663 - OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenLis

CVE-2026-77366 - obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1

CVE-2026-77364 - obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1

CVE-2026-77363 - obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1

CVE-2026-6232 - An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiv

CVE-2026-61994 - Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectl

CVE-2026-42689 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerab

CVE-2026-109448 - Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls h

CVE-2026-109222 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-108918 - A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file

CVE-2026-108917 - A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing

CVE-2026-108916 - A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the f

CVE-2026-108915 - A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /g

CVE-2026-108486 - Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly

CVE-2026-108482 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-108481 - Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows

CVE-2026-108479 - Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows

CVE-2026-107862 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-107418 - Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Con

CVE-2026-103080 - External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sal

CVE-2026-94451 - Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities.

CVE-2026-85976 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not suffici

CVE-2026-85975 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleart

CVE-2026-85974 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consist

CVE-2026-85973 - Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluste

CVE-2026-85972 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not suffici

CVE-2026-85971 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly

CVE-2026-85970 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML ext

CVE-2026-85969 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out

CVE-2026-85968 - Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in

CVE-2026-85967 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cros

CVE-2026-85966 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not suffici

CVE-2026-85965 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain memory

CVE-2026-85964 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authe

CVE-2026-85963 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprec

CVE-2026-85962 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an imp

CVE-2026-85961 - On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before

CVE-2026-85960 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictabl

CVE-2026-85959 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consist

CVE-2026-85958 - Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an aut

CVE-2026-85957 - Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that

CVE-2026-84286 - ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without firs

CVE-2026-75888 - A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side R

CVE-2026-109374 - ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange tha

CVE-2026-109373 - ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that

CVE-2026-109372 - ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML ident

CVE-2026-109371 - ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 U

CVE-2026-109366 - Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip dow

CVE-2026-109365 - Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthent

CVE-2026-109364 - Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers t

CVE-2026-109363 - ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensu

CVE-2026-109362 - Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collab

CVE-2026-109361 - MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that u

CVE-2026-109360 - MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attacker

CVE-2026-109359 - Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer rec

CVE-2026-109358 - Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where

CVE-2026-109357 - LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization

CVE-2026-109356 - LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that

CVE-2026-109355 - LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_li

CVE-2026-109354 - LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that

CVE-2026-109353 - LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inj

CVE-2026-109352 - LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/d

CVE-2026-109351 - Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows

CVE-2026-109350 - Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious rem

CVE-2026-109349 - gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_heade

CVE-2026-109348 - Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers

CVE-2026-109347 - Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite

CVE-2026-109346 - better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the

CVE-2026-109345 - DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypas

CVE-2026-109344 - DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE m

CVE-2026-109343 - SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a ses

CVE-2026-109342 - SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC