CVE-2026-35505 - An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. I

CVE-2026-11541 - IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Application Se

CVE-2026-10585 - A stored cross-site scripting vulnerability was identified in GitHub Enterprise Server that allowed

CVE-2026-9132 - A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut

CVE-2026-9106 - A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed an OAut

CVE-2026-44628 - An unauthenticated attacker can crash the worklist server with a single crafted query when the serve

CVE-2026-13207 - FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no

CVE-2026-11594 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-10562 - An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improp

CVE-2025-36359 - IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expirati

CVE-2025-36336 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could all

CVE-2025-36333 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perfor

CVE-2025-36328 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sen

CVE-2025-36327 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass

CVE-2025-36324 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery

CVE-2025-36323 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This

CVE-2025-36321 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote a

CVE-2025-36320 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scriptin

CVE-2025-36319 - IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause

CVE-2025-12530 - IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear tex

CVE-2026-9836 - IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure

CVE-2026-9002 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a deni

CVE-2026-7874 - IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due

CVE-2026-7873 - IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command

CVE-2026-7871 - IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with

CVE-2026-7803 - IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper validatio

CVE-2026-7663 - IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p

CVE-2026-3602 - IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integr

CVE-2026-13773 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in

CVE-2026-13772 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke

CVE-2026-13759 - IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje

CVE-2026-13449 - IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external e

CVE-2026-12086 - IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevO

CVE-2026-12085 - IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.

CVE-2026-12084 - IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource

CVE-2026-11906 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C

CVE-2026-11806 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 is affected by an arbitrary fil

CVE-2026-11714 - IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability

CVE-2026-11712 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-11708 - IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in

CVE-2026-11595 - IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive info

CVE-2026-11546 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side re

CVE-2026-10564 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSRF). The legacy RSSRe

CVE-2026-10560 - IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil

CVE-2026-10546 - IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in

CVE-2026-10140 - IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows

CVE-2026-10134 - IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl

CVE-2026-10129 - IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) protection bypass

CVE-2026-10109 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due

CVE-2025-36372 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C

CVE-2026-58138 - Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit

CVE-2026-10513 - The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to a

CVE-2026-9263 - The Zephyr Bluetooth controller ISO Adaptation Layer (subsys/bluetooth/controller/ll_sw/isoal.c) fai

CVE-2026-8864 - The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Cont

CVE-2026-58377 - JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low

CVE-2026-58376 - Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows

CVE-2026-58375 - JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the

CVE-2026-58373 - CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_quer

CVE-2026-58372 - SeaweedFS before 4.34 contains a path traversal vulnerability in the S3 gateway DeleteMultipleObject

CVE-2026-58371 - SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Cont

CVE-2026-58370 - Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For t

CVE-2026-58369 - Woodpecker before 3.15.0 registers the /api/orgs/lookup/*org_full_name endpoint without authenticati

CVE-2026-58176 - RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints un

CVE-2026-58174 - Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named p

CVE-2026-58173 - Vibe-Trading before 0.1.10 contains a path traversal vulnerability that allows attackers to write fi

CVE-2026-58172 - Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha

CVE-2026-58171 - Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run ident

CVE-2026-58170 - Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal ident

CVE-2026-58169 - Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows

CVE-2026-58168 - DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privi

CVE-2026-58167 - Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext da

CVE-2026-58166 - OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that

CVE-2026-58165 - OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that

CVE-2026-49451 - The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common s

CVE-2026-10655 - The asynchronous SNTP client in Zephyr (subsys/net/lib/sntp/sntp.c, sntp_close_async) closed the UDP

CVE-2026-10654 - A race condition in the Zephyr Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rf

CVE-2026-10653 - The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference counts -- the per-h

CVE-2026-10652 - Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS responses in dns_unpack_

CVE-2026-48315 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48314 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48313 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48307 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XS

CVE-2026-48286 - Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth

CVE-2026-48285 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF)

CVE-2026-48283 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with

CVE-2026-48282 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname

CVE-2026-48281 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48277 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera

CVE-2026-48276 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with

CVE-2026-44948 - A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up t

CVE-2026-13455 - PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly c

CVE-2026-4360 - In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardl

CVE-2026-48192 - A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.

CVE-2026-44949 - A Rancher FleetWorkspace admission path allowed side effects to occur in the Rancher webhook handle

CVE-2026-44947 - A missing clean-up in the legacy Project Role Template Binding (PRTB) reconciler in Rancher version

CVE-2026-27957 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27956 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27955 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27883 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27882 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-27881 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-35098 - KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an

CVE-2026-35097 - KTM System e-BOK enforces a maximum password length of six numeric digits and does not permit the us

CVE-2026-35096 - KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and pas

CVE-2026-35095 - KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a

CVE-2026-14241 - Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti

CVE-2026-14178 - openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parse

CVE-2025-53648 - SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to

CVE-2026-8655 - Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredict

CVE-2026-8452 - Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or errone

CVE-2026-8451 - Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if N

CVE-2026-8403 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-6556 - @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path

CVE-2026-58374 - In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operati

CVE-2026-58116 - LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit

CVE-2026-58016 - A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gi

CVE-2026-58015 - A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authenti

CVE-2026-58014 - A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list fun

CVE-2026-58013 - A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the gi

CVE-2026-58012 - A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used wit

CVE-2026-58011 - A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd

CVE-2026-58010 - A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the g

CVE-2026-53433 - fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --list

CVE-2026-53432 - fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line len

CVE-2026-4629 - A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit

CVE-2026-47105 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-44946 - A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler di

CVE-2026-14209 - A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative u

CVE-2026-13474 - Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is

CVE-2026-12388 - A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manag

CVE-2026-10817 - Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if t

CVE-2026-10816 - Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP,

CVE-2026-8402 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-57082 - Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a no

CVE-2026-57081 - Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested ben

CVE-2026-57080 - Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-

CVE-2026-57079 - Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path t

CVE-2026-53692 - Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because MD5

CVE-2026-53691 - An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers

CVE-2026-53690 - An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in t

CVE-2026-41053 - Incorrect authentication caching in the team member ship expansion of the Rancher Github authenticat

CVE-2026-14162 - Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo

CVE-2026-14161 - Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo

CVE-2026-13766 - DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers.

CVE-2026-54475 - Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

CVE-2026-53917 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A

CVE-2026-53916 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A

CVE-2026-52760 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-50750 - Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache

CVE-2026-50734 - Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ

CVE-2026-49877 - Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console

CVE-2026-49434 - Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ

CVE-2026-49432 - Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Sto

CVE-2026-13316 - A flaw has been found in foreman when HTTP parameters are modified in http_proxies_controller and ht

CVE-2026-9711 - The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S

CVE-2026-8141 - The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t

CVE-2026-6954 - Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability a

CVE-2026-6953 - HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an att

CVE-2026-13149 - brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exp

CVE-2026-12610 - A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due t

CVE-2026-12076 - Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline.  The vulnerabili

CVE-2026-10763 - PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack

CVE-2025-7406 - Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker

CVE-2025-24816 - Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorizat

CVE-2025-24815 - Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file t

CVE-2026-45822 - decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits

CVE-2026-12578 - The affected product is vulnerable to a deserialization of untrusted data, which may allow an attack

CVE-2026-9576 - The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_i

CVE-2026-56809 - Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor co

CVE-2026-56808 - DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, w

CVE-2026-56137 - RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerabili

CVE-2026-14164 - A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially c

CVE-2026-12819 - Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authenticat

CVE-2026-12818 - Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits

CVE-2026-12240 - The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficie

CVE-2026-11590 - The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sanitize user-s

CVE-2026-11589 - The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not properly valida

CVE-2026-11581 - The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.13 does not saniti

CVE-2026-8944 - The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site

CVE-2026-12560 - The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored C

CVE-2026-12349 - The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification

CVE-2026-12073 - The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privil

CVE-2026-11367 - The PixMagix – WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in a

CVE-2026-14160 - Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allo

CVE-2026-12114 - The Team Members – Multi Language Supported Team Plugin plugin for WordPress is vulnerable to Stored

CVE-2026-58302 - rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed S

CVE-2026-12243 - NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issu

CVE-2026-8023 - Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE

CVE-2026-7656 - The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input,

CVE-2026-51219 - A heap buffer overflow in the HighPriorityASDUQueue_hasUnconfirmedIMessages function of lib60870 v2.

CVE-2026-51218 - A heap buffer overflow in the TS7Worker::PerformFunctionWrite() function (/core/s7_server.cpp) of sn

CVE-2026-10648 - mcumgr_serial_process_frag() in subsys/mgmt/mcumgr/transport/src/serial_util.c calls net_buf_reset()

CVE-2026-57997 - Strapi users-permissions plugin fails to restrict JWT algorithms when plugin::users-permissions.jwt.

CVE-2026-51221 - A buffer overflow in the Get_Attribute_List function of EIPStackGroup OpENer commit 76b95c allows at

CVE-2026-34592 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-10647 - The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value

CVE-2026-55957 - Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was config

CVE-2026-55956 - Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for th

CVE-2026-55955 - Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the Encryptio

CVE-2026-55276 - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles

CVE-2026-53434 - Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for

CVE-2026-53404 - Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant th

CVE-2026-50229 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the n

CVE-2026-41896 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-34597 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-34594 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-13758 - CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in t

CVE-2026-57919 - PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\P

CVE-2026-57498 - Coolify is an open-source and self-hostable tool for managing servers, applications, and databases.

CVE-2026-56018 - JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowi

CVE-2026-56017 - JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when th

CVE-2026-54889 - Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex al

CVE-2026-54888 - Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Ma

CVE-2026-53429 - Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native a

CVE-2026-53426 - Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessiv

CVE-2026-43746 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43745 - An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Sa

CVE-2026-43743 - A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and i

CVE-2026-43742 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43740 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.

CVE-2026-43735 - The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i

CVE-2026-43734 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43732 - A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2,

CVE-2026-43731 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43727 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43726 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43725 - The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26

CVE-2026-43724 - The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPad

CVE-2026-43722 - The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPad

CVE-2026-43721 - This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iO

CVE-2026-43720 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43718 - A stack overflow was addressed with improved input validation. This issue is fixed in Safari 26.5.2,

CVE-2026-43717 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43716 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.

CVE-2026-43715 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43713 - A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 26.5.2

CVE-2026-43712 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.

CVE-2026-43709 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43708 - The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26

CVE-2026-43707 - A memory corruption issue was addressed with improved memory handling. This issue is fixed in Safari

CVE-2026-43706 - A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.5.2

CVE-2026-43705 - A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS

CVE-2026-43704 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43703 - The issue was addressed with improved memory handling. This issue is fixed in iOS 26.5.2 and iPadOS

CVE-2026-43701 - The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i

CVE-2026-43700 - A cross-origin issue was addressed with improved tracking of security origins. This issue is fixed i

CVE-2026-43699 - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari

CVE-2026-43676 - An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Sa

CVE-2026-43663 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.

CVE-2026-39872 - The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.