CVE-2026-65370 - ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request s

CVE-2026-64826 - rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to

CVE-2026-62421 - Rejected reason: Voluntarily withdrawn

CVE-2026-19654 - A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module

CVE-2026-19503 - MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authoriza

CVE-2026-19502 - MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file l

CVE-2026-19130 - A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An at

CVE-2026-19004 - An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when

CVE-2026-19002 - A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector

CVE-2026-19001 - The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an app

CVE-2026-18888 - The MongoDB BI Connector ODBC Driver converts floating point column values into text without checkin

CVE-2026-18097 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 C

CVE-2026-18096 - IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacke

CVE-2026-17616 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-16695 - IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbit

CVE-2026-16480 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vu

CVE-2026-16033 - A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unco

CVE-2026-14866 - IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certifica

CVE-2026-13622 - A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live

CVE-2026-13476 - IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute ar

CVE-2026-13433 - IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified

CVE-2026-13367 - IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in th

CVE-2026-13105 - IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal expl

CVE-2026-13094 - IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on

CVE-2026-11932 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-10543 - IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with

CVE-2026-73434 - A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the n

CVE-2026-73433 - A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI

CVE-2026-73415 - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup

CVE-2026-73414 - Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFuncti

CVE-2026-73413 - Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the fl

CVE-2026-73412 - Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts us

CVE-2026-73411 - Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFuncti

CVE-2026-73409 - Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mong

CVE-2026-73407 - Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/serv

CVE-2026-73406 - Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was

CVE-2026-73332 - CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin tha

CVE-2026-73331 - CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated at

CVE-2026-73330 - CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated

CVE-2026-73329 - CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privi

CVE-2026-73326 - CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privile

CVE-2026-73308 - Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/

CVE-2026-73307 - Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/util

CVE-2026-73306 - Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/logi

CVE-2026-73303 - Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibas

CVE-2026-73269 - A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCur

CVE-2026-73268 - A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant

CVE-2026-72809 - SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the

CVE-2026-72808 - SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulne

CVE-2026-72807 - SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view t

CVE-2026-72806 - SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPubl

CVE-2026-72805 - SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefTex

CVE-2026-72804 - SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph e

CVE-2026-72803 - SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGe

CVE-2026-72802 - SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPat

CVE-2026-72801 - SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data k

CVE-2026-72800 - SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID

CVE-2026-72799 - SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree pa

CVE-2026-72798 - SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeVie

CVE-2026-72797 - SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNot

CVE-2026-72796 - SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the

CVE-2026-72795 - SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBloc

CVE-2026-72794 - siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf

CVE-2026-72793 - SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf

CVE-2026-72792 - SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoin

CVE-2026-72791 - SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) conta

CVE-2026-72790 - SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebo

CVE-2026-72789 - SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating the

CVE-2026-72788 - SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter

CVE-2026-72787 - Craft CMS versions before 5.10.8 contain a stored cross-site scripting vulnerability in the control

CVE-2026-72786 - Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save

CVE-2026-72508 - A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Mana

CVE-2026-6821 - GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 bef

CVE-2026-67579 - Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacke

CVE-2026-63300 - An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go o

CVE-2026-63299 - An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level di

CVE-2026-63298 - An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration

CVE-2026-63297 - An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allow

CVE-2026-63296 - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target proje

CVE-2026-63295 - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-leve

CVE-2026-63294 - A link following vulnerability in LXD allows an attacker to achieve root command execution on the ho

CVE-2026-63293 - A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write op

CVE-2026-62420 - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target proje

CVE-2026-59917 - Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Acc

CVE-2026-59916 - Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Acc

CVE-2026-59914 - Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentic

CVE-2026-4879 - GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 bef

CVE-2026-49466 - Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below

CVE-2026-46731 - Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentic

CVE-2026-19657 - ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthe

CVE-2026-19656 - ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenti

CVE-2026-19643 - An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some pla

CVE-2026-19642 - An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow

CVE-2026-19228 - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2

CVE-2026-18679 - When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificat

CVE-2026-18433 - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2

CVE-2026-18150 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-18148 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content

CVE-2026-18099 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script

CVE-2026-17642 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman

CVE-2026-17445 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-17417 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman

CVE-2026-17111 - IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially c

CVE-2026-17083 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-

CVE-2026-17082 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges

CVE-2026-16494 - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2

CVE-2026-15217 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1

CVE-2026-15216 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1

CVE-2026-13361 - IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.

CVE-2026-13267 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-12618 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-12359 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-12005 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-12004 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-11937 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2026-11923 - IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3

CVE-2025-9486 - GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 19.0.6, 19.1 bef

CVE-2026-73301 - Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint

CVE-2026-19311 - Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an

CVE-2026-18952 - Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics

CVE-2026-18678 - When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate,

CVE-2026-18677 - In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives fro

CVE-2026-18676 - The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to

CVE-2026-18675 - The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the JWT kid head

CVE-2026-18673 - When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, i

CVE-2026-8667 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1

CVE-2026-7427 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1

CVE-2026-73327 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as the re

CVE-2026-73300 - Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Bu

CVE-2026-73299 - Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the T

CVE-2026-73298 - The Microsoft Container Migration Solution Accelerator is a multi-service application that provides

CVE-2026-69106 - A low-privileged user may poison cached artifact metadata under specific conditions, potentially cau

CVE-2026-49467 - Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions

CVE-2026-44741 - Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18

CVE-2026-42018 - JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when an

CVE-2026-18713 - IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authentica

CVE-2026-18669 - IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code

CVE-2026-18250 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-18244 - GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 bef

CVE-2026-18235 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Contro

CVE-2026-17420 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-17419 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to

CVE-2026-17418 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service

CVE-2026-17276 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due

CVE-2026-17271 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro

CVE-2026-17268 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-17266 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-17248 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic

CVE-2026-17222 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain S

CVE-2026-17218 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-o

CVE-2026-17110 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman

CVE-2026-17109 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameter

CVE-2026-16956 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands d

CVE-2026-16931 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro

CVE-2026-16907 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code d

CVE-2026-16906 - IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with el

CVE-2026-16904 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman

CVE-2026-16863 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-16860 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code d

CVE-2026-16856 - IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutrali

CVE-2026-16627 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that u

CVE-2026-15423 - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1

CVE-2026-73297 - Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t

CVE-2026-73296 - Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t

CVE-2026-73295 - Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9

CVE-2026-73240 - Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects

CVE-2026-73239 - Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types

CVE-2026-73238 - XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1

CVE-2026-73237 - XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.1

CVE-2026-48554 - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code

CVE-2026-48553 - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code

CVE-2026-48552 - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scrip

CVE-2026-48551 - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protect

CVE-2026-48550 - Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scrip

CVE-2026-18847 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials du

CVE-2026-18683 - IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authentic

CVE-2026-18499 - IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege es

CVE-2026-18246 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-18144 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-18106 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-18098 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-17095 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-17094 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-16694 - IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows

CVE-2026-73325 - Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability tha

CVE-2026-73294 - Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi

CVE-2026-73293 - Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3

CVE-2026-73292 - Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/pas

CVE-2026-70547 - An authenticated user without repository read permission may access package metadata under specific

CVE-2026-69107 - An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditio

CVE-2026-69105 - An unauthenticated attacker may cause untrusted package content to be cached under specific conditio

CVE-2026-68971 - Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and t

CVE-2026-68970 - Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so sec

CVE-2026-68969 - Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext w

CVE-2026-68968 - Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever

CVE-2026-68759 - A holder of a valid integration credential may impersonate other users under specific conditions.

CVE-2026-68758 - A low-privileged authenticated user may access restricted support information under specific conditi

CVE-2026-68076 - Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable

CVE-2026-67587 - Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constru

CVE-2026-67260 - Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task

CVE-2026-66384 - An authenticated user may write data outside the intended Docker cache path under specific remote-re

CVE-2026-66016 - Under specific self-hosted Helm configurations, generated TLS private keys may be retained in render

CVE-2026-65941 - In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network a

CVE-2026-65940 - In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files t

CVE-2026-65939 - In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile acti

CVE-2026-65938 - In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Sc

CVE-2026-65937 - In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend con

CVE-2026-65926 - An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may lea

CVE-2026-65017 - Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team de

CVE-2026-64639 - Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low

CVE-2026-59244 - Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the

CVE-2026-59242 - Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a strin

CVE-2026-58076 - Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a

CVE-2026-54183 - Apache Airflow's secrets masker hides values stored under sensitive key names when they are displaye

CVE-2026-19548 - Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.

CVE-2026-15803 - In Eclipse RDF4J, several XML parser entry points do not fully restrict XML External Entity (XXE) pr

CVE-2025-35988 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-35977 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-32737 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-32087 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-32084 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-31943 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-30178 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-27570 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-27245 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-25275 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-24837 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-24488 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2025-20020 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because i

CVE-2026-73432 - Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-insta

CVE-2026-73431 - Vulnerability-Lookup contains an authentication weakness in its account activation and password-rec

CVE-2026-73405 - An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accoun

CVE-2026-73374 - A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_

CVE-2026-73291 - Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to v

CVE-2026-73290 - RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous Li

CVE-2026-73289 - RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS evaluate

CVE-2026-73288 - RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock

CVE-2026-73287 - RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles

CVE-2026-73286 - RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_cond

CVE-2026-73285 - RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, R

CVE-2026-73284 - RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/

CVE-2026-73265 - RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId re

CVE-2026-73264 - Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provide

CVE-2026-73263 - Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep

CVE-2026-73262 - Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/li

CVE-2026-68760 - An unauthenticated user may bypass authentication under specific cache conditions.

CVE-2026-68757 - A user with access to a valid SAML response may impersonate another user under specific conditions.

CVE-2026-68756 - A party with write access to stored session data may affect JFrog Artifactory under specific conditi

CVE-2026-68755 - A bundle writer may create misleading release promotion information under specific conditions.

CVE-2026-68754 - A repository publisher without delete permission may modify protected package content under specific