CVE-2026-64278 - In the Linux kernel, the following vulnerability has been resolved: i2c: imx-lpi2c: mark I2C adapte

CVE-2026-64277 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound t

CVE-2026-64276 - In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound t

CVE-2026-64275 - In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - prevent divis

CVE-2026-64274 - In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the devic

CVE-2026-64273 - In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the devic

CVE-2026-64272 - In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch index

CVE-2026-64271 - In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the pac

CVE-2026-64270 - In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - reject an overs

CVE-2026-64269 - In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Bound RDMA-Write

CVE-2026-64268 - In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response p

CVE-2026-64267 - In the Linux kernel, the following vulnerability has been resolved: fuse: avoid 32-bit prune notifi

CVE-2026-64266 - In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re

CVE-2026-64265 - In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_

CVE-2026-64264 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix EFAULT clobber

CVE-2026-64263 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelle

CVE-2026-64262 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fuse_req on io-

CVE-2026-64261 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid use-after-fre

CVE-2026-64260 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stoppe

CVE-2026-64259 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on

CVE-2026-64258 - In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less

CVE-2026-64257 - In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping

CVE-2026-64256 - In the Linux kernel, the following vulnerability has been resolved: xfs: don't wrap around quota id

CVE-2026-16766 - Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P

CVE-2026-15425 - The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnera

CVE-2026-14955 - The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Trav

CVE-2026-10818 - The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a

CVE-2026-66374 - Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ

CVE-2026-66373 - Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows

CVE-2026-66339 - A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup in

CVE-2026-66338 - A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function

CVE-2026-66337 - A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_unti

CVE-2026-61892 - Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

CVE-2026-61886 - Weintek cMT3092X HMI stores user account passwords in plaintext.

CVE-2026-60135 - An attacker can modify data that should be restricted to read‑only access.

CVE-2026-60134 - Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

CVE-2026-16280 - An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncatio

CVE-2026-61884 - The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an inst

CVE-2026-55985 - The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credent

CVE-2025-71408 - NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the

CVE-2026-66041 - FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability

CVE-2026-66040 - FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in

CVE-2026-66039 - FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in t

CVE-2026-66038 - FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in t

CVE-2026-66037 - FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnera

CVE-2026-66036 - FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in

CVE-2026-62835 - Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over

CVE-2026-57531 - Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emo

CVE-2026-57530 - Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-

CVE-2026-54342 - In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any bac

CVE-2026-48037 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48036 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48035 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48034 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48033 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48032 - Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp

CVE-2026-48021 - In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between ep

CVE-2026-17107 - A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Manag

CVE-2026-66035 - libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow

CVE-2026-66034 - libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that

CVE-2026-66033 - libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vul

CVE-2026-66032 - libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_op

CVE-2026-65711 - sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica

CVE-2026-65710 - sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authentica

CVE-2026-65709 - sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JS

CVE-2026-65708 - sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allow

CVE-2026-65707 - Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level

CVE-2026-65623 - Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote den

CVE-2026-66027 - Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that all

CVE-2026-65693 - Microweber CMS through 2.0.20 contains a server-side template injection vulnerability that allows au

CVE-2026-64255 - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate st

CVE-2026-64254 - In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() w

CVE-2026-64253 - In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS

CVE-2026-64252 - In the Linux kernel, the following vulnerability has been resolved: MIPS: DEC: Prevent initial cons

CVE-2026-64251 - In the Linux kernel, the following vulnerability has been resolved: pwrseq: core: fix use-after-fre

CVE-2026-64250 - In the Linux kernel, the following vulnerability has been resolved: LoongArch: Report dying CPU to

CVE-2026-64249 - In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-fre

CVE-2026-64248 - In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to

CVE-2026-64247 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: hyper-v: Bound the ba

CVE-2026-64246 - In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-power

CVE-2026-64245 - In the Linux kernel, the following vulnerability has been resolved: fbdev: modedb: fix a possible U

CVE-2026-64244 - In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem->a

CVE-2026-64243 - In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: simple-mux: Fix e

CVE-2026-64242 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix doubl

CVE-2026-64241 - In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs a

CVE-2026-64240 - In the Linux kernel, the following vulnerability has been resolved: media: rc: igorplugusb: fix con

CVE-2026-64239 - In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: delete

CVE-2026-64238 - In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix deadlock on s

CVE-2026-64237 - In the Linux kernel, the following vulnerability has been resolved: Input: elan_i2c - validate firm

CVE-2026-64236 - In the Linux kernel, the following vulnerability has been resolved: i2c: davinci: fix division by z

CVE-2026-64235 - In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relat

CVE-2026-64234 - In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add chec

CVE-2026-64233 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lo

CVE-2026-64232 - In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s

CVE-2026-64231 - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registe

CVE-2026-64230 - In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_da

CVE-2026-64229 - In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB f

CVE-2026-64228 - In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL d

CVE-2026-64227 - In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPAN

CVE-2026-64226 - In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_roo

CVE-2026-64225 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds c

CVE-2026-64224 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free i

CVE-2026-64223 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only pr

CVE-2026-64222 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free

CVE-2026-64221 - In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-fre

CVE-2026-64220 - In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->se

CVE-2026-64219 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate paylo

CVE-2026-64218 - In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_wor

CVE-2026-64217 - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in net

CVE-2026-64216 - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in net

CVE-2026-64215 - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc ret

CVE-2026-64214 - In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant

CVE-2026-64213 - In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protecti

CVE-2026-64212 - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't deref

CVE-2026-64211 - In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue han

CVE-2026-64210 - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked wr

CVE-2026-64209 - In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of

CVE-2026-64208 - In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of

CVE-2026-17039 - A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform t

CVE-2026-8789 - The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to

CVE-2026-8308 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-7007 - The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsy

CVE-2026-66007 - Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-b

CVE-2026-66006 - lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in t

CVE-2026-66005 - Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its lo

CVE-2026-66004 - BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_a

CVE-2026-58630 - Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges o

CVE-2026-58586 - Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does

CVE-2026-57106 - Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privil

CVE-2026-56163 - Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unautho

CVE-2026-55732 - Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C

CVE-2026-55731 - Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE,

CVE-2026-55730 - Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms

CVE-2026-55729 - Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 bef

CVE-2026-55728 - Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME20

CVE-2026-49326 - Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan oper

CVE-2026-17059 - A flaw was found in the role-users endpoint of the keycloak-services library, which is the core comp

CVE-2026-16802 - Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Univer

CVE-2026-16801 - Improper control of generation of code ('Code Injection') in the variables feature in Devolutions Po

CVE-2026-16800 - Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions Pow

CVE-2026-16799 - Improper access control in the automation tests and workflows features in Devolutions PowerShell Uni

CVE-2026-16798 - Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShe

CVE-2026-12504 - Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-RO

CVE-2026-12503 - Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB,

CVE-2026-12502 - Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-

CVE-2026-12496 - Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX

CVE-2026-17048 - A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients

CVE-2026-9765 - Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.

CVE-2026-7484 - External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS

CVE-2026-66144 - Although remote policy references are not retrieved during policy normalization, if they are manuall

CVE-2026-66143 - It is possible to bypass the maximum number of normalized policy alternatives that was introduced in

CVE-2026-66142 - Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or

CVE-2026-66010 - DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via

CVE-2026-66009 - Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL valid

CVE-2026-66008 - Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and

CVE-2026-46452 - Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result i

CVE-2026-45816 - NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This req

CVE-2026-45815 - Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R

CVE-2026-45813 - Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS serv

CVE-2026-45812 - Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertisi

CVE-2026-45811 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBL

CVE-2026-16743 - A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-suppli

CVE-2026-16730 - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE er

CVE-2026-15810 - A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.

CVE-2026-15243 - Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client i

CVE-2026-10610 - Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged

CVE-2026-7483 - Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully con

CVE-2026-16634 - TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The

CVE-2026-15663 - The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to

CVE-2026-15401 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc

CVE-2026-10033 - The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions u

CVE-2026-63317 - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP

CVE-2026-56392 - GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow duri

CVE-2026-56391 - GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte inp

CVE-2026-49745 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-49744 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-49743 - Software installed and run as a non-privileged user may conduct improper GPU system calls to manipul

CVE-2026-24727 - An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload functio

CVE-2026-15821 - The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cr

CVE-2026-15739 - The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripti

CVE-2026-15704 - In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln

CVE-2026-15346 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site

CVE-2026-12702 - In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an

CVE-2026-16910 - A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notif

CVE-2026-16519 - A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The

CVE-2026-15755 - The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site

CVE-2026-15665 - The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to

CVE-2026-15653 - The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerab

CVE-2026-15648 - The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wi

CVE-2026-15464 - The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_s

CVE-2026-15334 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

CVE-2026-15333 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

CVE-2026-12654 - The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypas

CVE-2026-14603 - The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorizatio

CVE-2026-14172 - Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated

CVE-2026-12981 - The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation wh

CVE-2026-12877 - The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti

CVE-2026-12690 - The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license

CVE-2026-12689 - The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership che

CVE-2026-12688 - The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before gra

CVE-2026-12497 - The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C

CVE-2026-16870 - Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allo

CVE-2026-66141 - Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport i

CVE-2026-66140 - Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequ

CVE-2026-66139 - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is

CVE-2026-66138 - In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach

CVE-2026-54422 - In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ir

CVE-2026-6454 - The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in vers

CVE-2026-15420 - The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vuln

CVE-2026-15100 - The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-13464 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-12736 - The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl

CVE-2026-11922 - A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-l

CVE-2026-11354 - The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in al

CVE-2025-9205 - The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to,

CVE-2026-62825 - Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges ove

CVE-2026-58275 - Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw

CVE-2026-56191 - Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp

CVE-2026-56167 - Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privi

CVE-2026-56165 - Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over

CVE-2026-56160 - Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate pri

CVE-2026-54120 - Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a

CVE-2026-50517 - Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over

CVE-2026-49159 - Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized a

CVE-2026-35425 - Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code

CVE-2026-50044 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability

CVE-2026-44955 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a

CVE-2026-42933 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit

CVE-2026-40430 - Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability

CVE-2026-28698 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a

CVE-2026-16767 - A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extr

CVE-2026-65694 - Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller

CVE-2026-65604 - Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open

CVE-2026-63732 - 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (

CVE-2026-63313 - 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fet

CVE-2026-16807 - Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to

CVE-2026-16806 - Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execu

CVE-2026-16805 - Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execut

CVE-2026-16804 - Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had c

CVE-2026-16765 - A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk

CVE-2026-16764 - A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSeria

CVE-2026-16763 - A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element

CVE-2025-71389 - Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because

CVE-2024-58355 - Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability

CVE-2024-58354 - cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerabilit

CVE-2024-58353 - Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS

CVE-2026-6924 - A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such,

CVE-2026-52439 - An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.ne

CVE-2026-50103 - A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adja

CVE-2026-50039 - The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to