CVE-2026-66404 - DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Opera

CVE-2026-66403 - DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor ma

CVE-2026-21084 - Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access s

CVE-2026-21083 - Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to acc

CVE-2026-21082 - Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access se

CVE-2026-21081 - Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x a

CVE-2026-21080 - Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent

CVE-2026-21079 - Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attac

CVE-2026-21078 - Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to versio

CVE-2026-21077 - Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access se

CVE-2026-21076 - Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access se

CVE-2026-21075 - Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows rem

CVE-2026-21074 - Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute a

CVE-2026-21073 - Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers

CVE-2026-21072 - Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local

CVE-2026-21071 - Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows loca

CVE-2026-21070 - Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attacke

CVE-2026-21069 - Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Releas

CVE-2026-21068 - Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local

CVE-2026-21067 - Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to wr

CVE-2026-21066 - Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local a

CVE-2026-21065 - Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attacker

CVE-2026-21064 - Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause de

CVE-2026-21063 - Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows

CVE-2026-64940 - Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a pe

CVE-2026-57279 - Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an

CVE-2026-21062 - Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers t

CVE-2026-21061 - Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers

CVE-2026-21060 - Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attack

CVE-2026-21059 - Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release

CVE-2026-21058 - Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers

CVE-2026-19089 - The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded fi

CVE-2026-19077 - The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in

CVE-2026-19075 - All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by `?vd

CVE-2026-19074 - The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin befor

CVE-2026-19053 - The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter bef

CVE-2026-19049 - The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before usin

CVE-2026-18960 - The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every aut

CVE-2026-18946 - The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copyin

CVE-2026-18934 - The RSS Aggregator by Feedzy WordPress plugin before 5.2.6 does not verify that the requesting user

CVE-2026-18786 - The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to

CVE-2026-18666 - The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supp

CVE-2026-18470 - The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset requ

CVE-2026-18469 - The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attemp

CVE-2026-18468 - The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verificat

CVE-2026-18200 - The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated

CVE-2026-18030 - The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when p

CVE-2026-17542 - The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its f

CVE-2026-17541 - The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST

CVE-2026-17540 - The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management comma

CVE-2026-17023 - The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or

CVE-2026-17022 - The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ow

CVE-2026-17021 - The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some

CVE-2026-17020 - The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking

CVE-2026-17019 - The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing a

CVE-2026-17018 - The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorizatio

CVE-2026-17016 - The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does no

CVE-2026-17012 - The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does no

CVE-2026-17010 - The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post meta

CVE-2026-16985 - The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-

CVE-2026-16949 - The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter befor

CVE-2026-16299 - The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset

CVE-2026-16298 - The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset reques

CVE-2026-16257 - The Arvow AI SEO Writer WordPress plugin before 1.5.4 does not properly restrict access to one of it

CVE-2026-15238 - The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before up

CVE-2026-15237 - The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or owne

CVE-2026-15229 - The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price

CVE-2026-15047 - The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before out

CVE-2026-14941 - The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capab

CVE-2026-14860 - The Podcast Player WordPress plugin before 8.3.1 does not validate the destination of a server-side

CVE-2026-14293 - The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before savi

CVE-2026-14238 - The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from

CVE-2026-14237 - The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a p

CVE-2026-14211 - The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that a

CVE-2026-14206 - The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the e

CVE-2026-13701 - The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings be

CVE-2026-13600 - The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication

CVE-2026-13170 - The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting befor

CVE-2026-13133 - A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, wher

CVE-2026-12971 - The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the serve

CVE-2026-12570 - A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack w

CVE-2026-17519 - Rejected reason: This is rejected.

CVE-2026-72522 - libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates a

CVE-2026-19389 - Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly

CVE-2026-19387 - A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element

CVE-2026-19384 - A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected

CVE-2026-19383 - A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts t

CVE-2026-19382 - A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in

CVE-2026-19381 - A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacte

CVE-2026-19380 - A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function

CVE-2026-19379 - A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the

CVE-2026-19378 - A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unkno

CVE-2026-19376 - A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function

CVE-2026-19375 - A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the

CVE-2026-19374 - A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593a

CVE-2026-19373 - A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue

CVE-2026-19372 - A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by

CVE-2026-19371 - A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function cop

CVE-2026-12372 - A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the curren

CVE-2026-19370 - A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeF

CVE-2026-19369 - A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of

CVE-2026-19368 - A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown func

CVE-2026-19367 - A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is a

CVE-2026-70395 - Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash all

CVE-2026-19366 - A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the

CVE-2026-19365 - A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown

CVE-2026-69659 - Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the

CVE-2026-19364 - A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element

CVE-2026-19363 - A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function o

CVE-2026-19362 - A vulnerability has been found in lmammino oidc-authorizer 0.4.0. This issue affects the function pa

CVE-2026-19361 - A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the fil

CVE-2026-15534 - Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matc

CVE-2026-19360 - A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLe

CVE-2026-19359 - A security vulnerability has been detected in nxp-auto-goldvip gvip up to 1.4.0. Affected by this is

CVE-2026-19358 - A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is t

CVE-2026-19357 - A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of

CVE-2026-19356 - A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the

CVE-2026-19355 - A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl

CVE-2026-19354 - A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impa

CVE-2026-19353 - A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the functio

CVE-2026-19352 - A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unk

CVE-2026-19351 - A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this v

CVE-2026-19350 - A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the fi

CVE-2026-19348 - A security flaw has been discovered in Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a. Impacted is t

CVE-2026-19347 - A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects so

CVE-2026-19346 - A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCe

CVE-2026-19345 - A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part

CVE-2026-19344 - A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue i

CVE-2026-19343 - A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is

CVE-2026-19342 - A vulnerability was detected in code-projects Task Management System 1.0. Affected is an unknown fun

CVE-2026-19341 - A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the

CVE-2026-19340 - A weakness has been identified in anubissbe ProjectHub-Mcp up to 5.0.0. This affects an unknown func

CVE-2026-19339 - A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The im

CVE-2026-19338 - A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is t

CVE-2026-19337 - A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown funct

CVE-2026-19336 - A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function

CVE-2026-19335 - A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability a

CVE-2026-18603 - The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not ha

CVE-2026-18473 - The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter

CVE-2026-18465 - The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX

CVE-2026-18464 - The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX

CVE-2026-18357 - The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or no

CVE-2026-18037 - The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering co

CVE-2026-18032 - The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on

CVE-2026-17044 - The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parame

CVE-2026-17017 - The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a paramete

CVE-2026-17014 - The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce

CVE-2026-17011 - The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through o

CVE-2026-16992 - The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning co

CVE-2026-16988 - The GeoDirectory WordPress plugin before 2.8.169 does not perform any authorization check when retu

CVE-2026-16965 - The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of

CVE-2026-16957 - The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts

CVE-2026-16032 - The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through a

CVE-2026-15038 - The InfiniteWP Client WordPress plugin before 1.13.6 does not properly verify the site-connection st

CVE-2026-19334 - A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This a

CVE-2026-19333 - A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03

CVE-2026-19332 - A security vulnerability has been detected in NellyW8 MCP4EDA 1.0.0. Affected by this vulnerability

CVE-2026-19331 - A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function r

CVE-2026-19330 - A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is t

CVE-2026-19329 - A vulnerability was found in andreahaku codex_mcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. Th

CVE-2026-10595 - A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catc

CVE-2026-19328 - A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getI

CVE-2026-19327 - A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnriche

CVE-2026-19326 - A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function

CVE-2026-19325 - A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up

CVE-2026-19324 - A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a

CVE-2026-17510 - Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attri

CVE-2026-71993 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71992 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71991 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71990 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71989 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71988 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71987 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71986 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71985 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-71984 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-19323 - A security flaw has been discovered in azer react-analyzer-mcp up to 335f2a3585f265e2e88352b59b10d3b

CVE-2026-71983 - MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the

CVE-2026-11612 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-71502 - CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutraliza

CVE-2026-71958 - D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain

CVE-2026-71957 - D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain

CVE-2026-71956 - D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain

CVE-2026-71955 - D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain

CVE-2026-71954 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71953 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71952 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71951 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71950 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71949 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71948 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71947 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71946 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71945 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-71944 - D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 c

CVE-2026-67620 - Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard impleme

CVE-2026-42170 - A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser.

CVE-2026-19288 - A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b75

CVE-2026-19287 - A flaw has been found in abrinsmead mindpilot-mcp 0.5.0. Affected by this issue is some unknown func

CVE-2026-19285 - A vulnerability was detected in aaronsb memory-graph up to 5cfd2382778837b9f6399080956eee670d00452c.

CVE-2026-19284 - A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the

CVE-2026-19282 - A weakness has been identified in andreahaku llm_memory_mcp up to f11dc8bcff3ff8cf943a2945f99ff3b0bd

CVE-2026-19281 - A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects t

CVE-2026-19279 - A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the functio

CVE-2026-68082 - In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare de

CVE-2026-68081 - In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if

CVE-2026-19270 - A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function g

CVE-2026-19268 - A vulnerability was identified in abdullah1854 MCPGateway up to 549f494a9e363f40530149de324b8097de42

CVE-2026-19266 - A vulnerability was determined in Kirachon context-engine up to 1.9.0. This affects the function exe

CVE-2026-19263 - A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e0611

CVE-2026-19259 - A vulnerability has been found in MZ Automation libiec61850 up to 1.6.1. The affected element is the

CVE-2026-16955 - The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before rea

CVE-2026-16953 - The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot

CVE-2026-16948 - The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its

CVE-2026-16608 - The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of i

CVE-2026-16595 - The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on

CVE-2026-16594 - The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on

CVE-2026-16590 - The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on

CVE-2026-16589 - The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before u

CVE-2026-16578 - The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin

CVE-2026-16574 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 d

CVE-2026-16562 - The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of

CVE-2026-16559 - The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of it

CVE-2026-16558 - The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting

CVE-2026-16535 - The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before refle

CVE-2026-16282 - The Appointment Hour Booking WordPress plugin before 1.5.88 does not validate a client-supplied boo

CVE-2026-16269 - The Newsletters WordPress plugin before 4.16 does not strictly compare its API authentication key, a

CVE-2026-16267 - The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialisin

CVE-2026-14526 - The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all

CVE-2026-18988 - The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accord

CVE-2026-13505 - In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series)

CVE-2026-8798 - In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Inte

CVE-2026-52880 - Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1

CVE-2026-52879 - Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7

CVE-2026-52878 - Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17

CVE-2026-49343 - Klever-Go is the Go implementation of the Klever blockchain protocol. In versions prior to 1.7.18, t

CVE-2026-48122 - Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level sett

CVE-2026-48120 - Kakoune is a code editor. Prior to version 2026.05.21, the bundled, enabled by default, `autorestore

CVE-2026-48047 - XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.

CVE-2026-48026 - lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to

CVE-2026-47249 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resol

CVE-2026-47127 - Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe

CVE-2026-46409 - OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace buil

CVE-2025-4438 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-64676 - Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform

CVE-2026-58262 - Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signat

CVE-2026-48170 - `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution w

CVE-2026-48169 - PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have

CVE-2026-47243 - Kata Containers is an open source project focusing on a standard implementation of lightweight Virtu