CVE-2026-66031 - Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability

CVE-2026-64647 - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15

CVE-2026-64646 - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15

CVE-2026-51244 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-17612 - Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.

CVE-2026-16481 - A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-h

CVE-2026-12383 - A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permi

CVE-2026-10683 - In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_

CVE-2026-10682 - The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_

CVE-2026-66030 - Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerabilit

CVE-2026-66029 - Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability

CVE-2026-66028 - Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerabili

CVE-2026-64645 - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15

CVE-2026-64644 - Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15

CVE-2026-64643 - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15

CVE-2026-64642 - Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16

CVE-2026-64641 - Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15

CVE-2026-59239 - Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 al

CVE-2026-55579 - Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi

CVE-2026-55578 - Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi

CVE-2026-54540 - Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is a

CVE-2026-54272 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions

CVE-2026-51235 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-48052 - Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an auth

CVE-2026-48051 - Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's

CVE-2026-48030 - Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi

CVE-2026-45623 - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rul

CVE-2026-17570 - Improper access control in the PAM password history endpoints in Devolutions Server allows an authen

CVE-2026-17569 - Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated use

CVE-2026-17568 - Improper access control in the role membership management endpoint in Devolutions Server allows an a

CVE-2026-17552 - Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated

CVE-2026-66731 - facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked tran

CVE-2026-66730 - facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser

CVE-2026-66729 - facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body

CVE-2026-66391 - Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. T

CVE-2026-66390 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-63077 - In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible

CVE-2026-24252 - NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s

CVE-2026-17531 - A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some u

CVE-2026-17192 - A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on

CVE-2026-17191 - An input validation vulnerability exists in an API component of the orchestrator. An authenticated u

CVE-2026-66399 - phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMember

CVE-2026-66398 - phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that

CVE-2026-66397 - phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during

CVE-2026-66396 - SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Ga

CVE-2026-66395 - SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p

CVE-2026-66394 - SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanit

CVE-2026-59251 - Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a

CVE-2026-59250 - Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticat

CVE-2026-58227 - The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certifi

CVE-2026-55953 - The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selec

CVE-2026-55737 - Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows

CVE-2026-54890 - Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang

CVE-2026-51304 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51303 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51302 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51300 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51298 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51297 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-51296 - Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by

CVE-2026-47078 - Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside

CVE-2026-42792 - Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauth

CVE-2026-17574 - HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an

CVE-2026-17573 - A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file conta

CVE-2026-17572 - Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all

CVE-2026-17530 - A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerabil

CVE-2026-17529 - A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function

CVE-2026-16812 - VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attack

CVE-2025-50455 - SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al

CVE-2026-66477 - Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

CVE-2026-66476 - Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

CVE-2026-66475 - Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Ma

CVE-2026-66474 - Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <=

CVE-2026-66448 - Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

CVE-2026-66445 - Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

CVE-2026-66442 - Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

CVE-2026-66438 - Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

CVE-2026-66437 - Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

CVE-2026-66434 - Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <

CVE-2026-66433 - Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

CVE-2026-66428 - Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

CVE-2026-66427 - Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

CVE-2026-66050 - NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer se

CVE-2026-65568 - Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

CVE-2026-65567 - Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

CVE-2026-65564 - Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

CVE-2026-65563 - Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

CVE-2026-65562 - Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.

CVE-2026-65561 - Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions.

CVE-2026-65558 - Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions.

CVE-2026-65557 - Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.

CVE-2026-65436 - Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions.

CVE-2026-65435 - Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

CVE-2026-65434 - Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

CVE-2026-65433 - Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <

CVE-2026-59560 - Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

CVE-2026-59559 - Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenb

CVE-2026-59558 - Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.

CVE-2026-59557 - Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

CVE-2026-59556 - Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <=

CVE-2026-59553 - Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.

CVE-2026-59552 - Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1.4.2

CVE-2026-59551 - Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

CVE-2026-59550 - Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

CVE-2026-59549 - Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

CVE-2026-59548 - Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <= 1.0.0 versions.

CVE-2026-59546 - Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.

CVE-2026-59539 - Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.

CVE-2026-59538 - Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

CVE-2026-59537 - Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer

CVE-2026-59536 - Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.

CVE-2026-59535 - Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.

CVE-2026-59534 - Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.

CVE-2026-59533 - Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

CVE-2026-59532 - Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

CVE-2026-59531 - Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.

CVE-2026-59530 - Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.

CVE-2026-59529 - Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.

CVE-2026-59528 - Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.

CVE-2026-59527 - Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

CVE-2026-10819 - Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail t

CVE-2026-10600 - Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail t

CVE-2025-59181 - Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerabi

CVE-2025-59180 - Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerab

CVE-2025-59178 - Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System

CVE-2025-59177 - Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuratio

CVE-2025-59172 - Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain an Improper Neutralization of S

CVE-2026-65879 - Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret

CVE-2026-65878 - Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1-

CVE-2026-65877 - Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improp

CVE-2026-65876 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Impr

CVE-2026-65766 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Impr

CVE-2026-61511 - vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB

CVE-2026-17514 - A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerabilit

CVE-2026-17513 - A vulnerability was found in ggml-org whisper.cpp 95ea8f9b. Affected is the function ggml_ftype_to_g

CVE-2026-15003 - A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-ov

CVE-2026-59690 - A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec

CVE-2026-59689 - An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Ob

CVE-2026-59688 - An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec

CVE-2026-59687 - An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec

CVE-2026-59686 - An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec

CVE-2026-56538 - An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this mi

CVE-2026-56537 - HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive

CVE-2026-17512 - A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function log_mel_s

CVE-2026-12991 - The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in G

CVE-2026-12990 - An access control vulnerability in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot a

CVE-2026-12989 - A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows a

CVE-2026-66053 - Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings

CVE-2026-58662 - Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif

CVE-2026-58389 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.

CVE-2026-58023 - Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift

CVE-2026-57917 - proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SS

CVE-2026-57916 - proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An att

CVE-2026-55971 - Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache T

CVE-2026-55970 - Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: bef

CVE-2026-55969 - Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Ha

CVE-2026-55968 - Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerabili

CVE-2026-49158 - Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby

CVE-2026-48586 - Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++,

CVE-2026-48145 - Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.

CVE-2026-48144 - Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings

CVE-2026-45112 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.

CVE-2026-43871 - Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PH

CVE-2026-41608 - Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Pyth

CVE-2026-14856 - A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Mana

CVE-2026-12495 - Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt functi

CVE-2026-40000 - The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is design

CVE-2026-17534 - Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static host

CVE-2026-17527 - In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to p

CVE-2026-17523 - In the Linux kernel, the following vulnerability has been resolved: can: bcm: switch timer to HRTIM

CVE-2026-65765 - Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper

CVE-2026-65764 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper

CVE-2026-16554 - cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on

CVE-2026-15799 - Rejected reason: This is a duplicate.

CVE-2026-65894 - This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoin

CVE-2026-65893 - This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in th

CVE-2026-64536 - In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea

CVE-2026-64535 - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF wh

CVE-2026-64534 - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED be

CVE-2026-64533 - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow

CVE-2026-64532 - In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.da

CVE-2026-64531 - In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversi

CVE-2026-14837 - Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH

CVE-2026-9830 - The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its

CVE-2026-66412 - Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated us

CVE-2026-14827 - The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field bef

CVE-2026-14820 - The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or

CVE-2026-14568 - The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & U

CVE-2026-14289 - The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one

CVE-2026-14236 - The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return

CVE-2026-14235 - The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to th

CVE-2026-14203 - The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rende

CVE-2026-14190 - The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructe

CVE-2026-14189 - The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifier

CVE-2026-13726 - The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it

CVE-2026-13714 - The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate th

CVE-2026-13597 - The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its

CVE-2026-13400 - Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all ver

CVE-2026-13390 - The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one

CVE-2026-13332 - The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unaut

CVE-2026-13152 - The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent

CVE-2026-12982 - The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input

CVE-2026-12493 - The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify

CVE-2026-12394 - The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end reg

CVE-2026-12255 - The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site

CVE-2026-10082 - The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter

CVE-2025-15662 - The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not r

CVE-2026-15928 - XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (X

CVE-2026-17501 - A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transfo

CVE-2026-17500 - A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit

CVE-2026-57990 - Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an una

CVE-2026-57989 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo

CVE-2026-57978 - Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor

CVE-2026-17497 - NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,

CVE-2026-17496 - NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injec

CVE-2026-17459 - A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the functi

CVE-2026-17458 - A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlay

CVE-2026-17457 - A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the fun

CVE-2026-64530 - In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_A

CVE-2024-14040 - In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight t

CVE-2026-63720 - datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows

CVE-2026-17434 - A flaw has been found in nanocoai NanoClaw up to 2.0.64. Affected is the function handleAddMcpServer

CVE-2026-17433 - A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. This impacts the function createChat

CVE-2026-15962 - The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all v

CVE-2026-17432 - A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability i

CVE-2026-10681 - In Zephyr's userspace dynamic-objects subsystem, thread_idx_alloc() in kernel/userspace/userspace.c

CVE-2026-66013 - OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration

CVE-2026-66012 - SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint

CVE-2026-66011 - ImageMagick before 7.1.2-27 contains a memory leak vulnerability in the magick command-line interfac

CVE-2026-64529 - In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused cha

CVE-2026-64528 - In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove re

CVE-2026-64527 - In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus pack

CVE-2026-64526 - In the Linux kernel, the following vulnerability has been resolved: ethtool: tsconfig: fix missing

CVE-2026-64525 - In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU syn

CVE-2026-64524 - In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate resolution

CVE-2026-64523 - In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-live

CVE-2026-64522 - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode blo

CVE-2026-64521 - In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix

CVE-2026-64520 - In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Bound PARTIT

CVE-2026-64519 - In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix infinite loop in layo

CVE-2026-64518 - In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access f

CVE-2026-64517 - In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of

CVE-2026-64516 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firm

CVE-2026-64515 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragm

CVE-2026-64514 - In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate must_wait wri

CVE-2026-64513 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Unconditionally recom

CVE-2026-64512 - In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warn

CVE-2026-64511 - In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix possible

CVE-2026-64510 - In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit

CVE-2026-64509 - In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanu