CVE-2026-102020 - A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evo

CVE-2026-102019 - An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Ne

CVE-2026-102018 - A NULL Pointer Dereference vulnerability in the rpd process of Juniper Networks Junos OS and Junos O

CVE-2026-102017 - An Out-of-bounds Write vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Ev

CVE-2026-102016 - An Improper Validation of Specified Quantity in Input vulnerability in the rpd process of Juniper Ne

CVE-2026-102015 - A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos

CVE-2026-102014 - A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows

CVE-2026-102013 - A NULL Pointer Dereference vulnerability in the na-grpcd process of Juniper Networks Junos OS and Ju

CVE-2026-102012 - A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks Junos OS Evolved all

CVE-2026-102011 - A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO al

CVE-2026-102000 - A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO al

CVE-2026-101999 - A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos OS and Junos EVO al

CVE-2026-101997 - An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit

CVE-2026-101996 - A Reachable Assertion vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos O

CVE-2026-101995 - An Improper Validation of Specified Quantity in Input vulnerability in the l2ald of Juniper Netw

CVE-2026-101994 - An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juni

CVE-2026-101993 - A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos O

CVE-2026-101992 - An Improper Input Validation vulnerability in the routing protocol daemon (rpd) process of Juniper N

CVE-2026-101991 - An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon

CVE-2026-101990 - A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks

CVE-2026-101989 - A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos O

CVE-2026-101988 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

CVE-2026-101987 - An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of J

CVE-2026-101986 - An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS and Junos OS Evolved

CVE-2026-101985 - A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (r

CVE-2026-101984 - A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos O

CVE-2026-101980 - An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS with Extended Echo con

CVE-2026-101978 - An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networ

CVE-2026-101977 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

CVE-2026-101974 - An Improper Validation of Specified Quantity in Input vulnerability in rpd of Juniper Networks Junos

CVE-2026-101973 - A NULL Pointer Dereference vulnerability in the pkid component of Juniper Networks Junos OS allows a

CVE-2026-101971 - An Allocation of Resources Without Limits or Throttling vulnerability in rpd, the routing protocol d

CVE-2026-101970 - A Use After Free vulnerability in the rpd PIM Join/Prune processing of Juniper Networks Junos OS and

CVE-2026-101969 - An Improper Input Validation vulnerability in the rpd process of Juniper Networks Junos OS and Junos

CVE-2026-101968 - An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Juniper Networks Junos

CVE-2026-101967 - An OS Command Injection vulnerability in the bootzd zero-touch provisioning daemon of Juniper Networ

CVE-2026-101966 - A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks J

CVE-2026-101965 - An Use of Externally-Controlled Format String vulnerability in the gRPC daemon of Juniper Networks J

CVE-2026-101960 - An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos

CVE-2026-101957 - An Improper Initialization vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

CVE-2026-101956 - An Improper Authentication vulnerability in the J-Web web management component of Juniper Networks J

CVE-2026-101955 - A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on

CVE-2026-101951 - An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd

CVE-2026-101950 - A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX

CVE-2026-101948 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

CVE-2026-101946 - An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evo

CVE-2026-101945 - An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Networks Junos OS and

CVE-2026-101944 - An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (rpd) of Juniper Netw

CVE-2026-101943 - An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks

CVE-2026-101942 - An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon

CVE-2026-101941 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Ju

CVE-2026-101940 - A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and

CVE-2026-101939 - A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of Juniper Networks Ju

CVE-2026-101938 - An Integer Underflow (Wrap or Wraparound) vulnerability in the srxpfe of Juniper Networks Junos OS a

CVE-2026-101937 - A Signed to Unsigned Conversion Error vulnerability in the srxpfe of Juniper Networks Junos OS on th

CVE-2026-101936 - A Reachable Assertion vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series

CVE-2026-101934 - An Out-of-bounds Write vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolved all

CVE-2026-101927 - A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos OS and Junos OS Evolv

CVE-2026-100236 - A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, i

CVE-2016-15060 - A vulnerability was found in PCMan FTP Server up to 2.0.7. This affects an unknown function of the c

CVE-2026-93683 - A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the ho

CVE-2026-91883 - Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive In

CVE-2026-91882 - Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive In

CVE-2026-91881 - Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Valid

CVE-2026-91159 - Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9

CVE-2026-91157 - Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9

CVE-2026-91156 - Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9

CVE-2026-89077 - Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP

CVE-2026-89076 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-89075 - Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue aff

CVE-2026-89074 - Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects

CVE-2026-89073 - Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEi

CVE-2026-89072 - Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). Thi

CVE-2026-89071 - Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability i

CVE-2026-89070 - Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). Th

CVE-2026-89069 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-89068 - Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). Th

CVE-2026-89067 - Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer.

CVE-2026-87093 - Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. Th

CVE-2026-86561 - A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost

CVE-2026-86002 - Dokku is a docker-powered platform as a service. In Dokku versions before 0.38.25, a user with app-l

CVE-2026-77572 - VeraCrypt provides disk encryption with strong security based on TrueCrypt. In 1.26.29 and earlier,

CVE-2026-76113 - Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive

CVE-2026-67416 - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, th

CVE-2026-67414 - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, de

CVE-2026-62858 - YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_requ

CVE-2026-53615 - util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, `parse_dos_extended(

CVE-2026-53614 - util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 t

CVE-2026-49206 - rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRo

CVE-2026-110736 - Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translation loader (core/strin

CVE-2026-110735 - Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/res

CVE-2026-110734 - Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.hdr) image decoder (

CVE-2026-110719 - Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that a

CVE-2026-110718 - TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allo

CVE-2026-110717 - Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin

CVE-2026-110716 - unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshield_get_file_table()

CVE-2026-110715 - MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototyp

CVE-2026-110714 - libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious

CVE-2026-110713 - libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_fs_volume_i

CVE-2026-110712 - libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info th

CVE-2026-110661 - CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_read_node_header that a

CVE-2026-110660 - vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the G.722.1/Siren14 dec

CVE-2026-110659 - ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor

CVE-2026-110658 - Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse()

CVE-2026-110657 - Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulner

CVE-2026-110656 - miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml par

CVE-2026-110655 - miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml par

CVE-2026-110654 - libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that al

CVE-2026-109438 - 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory dis

CVE-2026-103929 - mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default n

CVE-2026-102893 - Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenI

CVE-2026-102695 - OmniFaces is a utility library for Faces. In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.

CVE-2026-101897 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-101896 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-100404 - Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users

CVE-2026-100394 - Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From

CVE-2026-100169 - Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0

CVE-2026-97629 - Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:

CVE-2026-97205 - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When async

CVE-2026-96615 - Description NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Res

CVE-2026-95101 - Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module.

CVE-2026-94197 - An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Contr

CVE-2026-93479 - A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching

CVE-2026-91184 - Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec

CVE-2026-84471 - The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_

CVE-2026-78433 - Gitea's web attachment handler skips its cross-repository ownership check for attachments created be

CVE-2026-78231 - When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HT

CVE-2026-73814 - Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repos

CVE-2026-73804 - Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the

CVE-2026-73802 - Gitea Runner passes workflow-controlled container options into Docker job container configuration wh

CVE-2026-73800 - Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch wo

CVE-2026-73539 - Gitea substitutes a URL derived from the markup Context field into external renderer command templat

CVE-2026-73535 - Gitea's OpenID connect handler accepts a user's password without enforcing enrolled TOTP or WebAuthn

CVE-2026-73273 - Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcin

CVE-2026-73135 - Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-

CVE-2026-73130 - Gitea does not limit the length of the gitignores field accepted by repository-creation forms and th

CVE-2026-73126 - Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-

CVE-2026-71301 - Gitea's repository markup endpoint resolves same-repository pull request references without enforcin

CVE-2026-71184 - Gitea's pull request review notifier does not attach the pull request to the Actions notification, s

CVE-2026-70407 - Gitea's organization-list API does not enforce the read:organization token scope. A token limited to

CVE-2026-70406 - Gitea's shared comparison helper omits the token repository-access check used when updating pull req

CVE-2026-70402 - Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process

CVE-2026-70400 - Gitea's repository migration API accepts a public-only token when the request specifies creation of

CVE-2026-70396 - Gitea's organization repository-creation API requires write:organization but omits the write:reposit

CVE-2026-68964 - Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their w

CVE-2026-68957 - Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when ev

CVE-2026-67577 - Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility chec

CVE-2026-66877 - Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and di

CVE-2026-66874 - For pull request events, Gitea reads workflow definitions from the pull request head and posts a syn

CVE-2026-66853 - Gitea's user organization-list API includes Limited-visibility organizations for authenticated restr

CVE-2026-66849 - Gitea's package registry grants authenticated users read access to packages owned by Limited-visibil

CVE-2026-63792 - Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does

CVE-2026-63021 - Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manife

CVE-2026-62925 - Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the deco

CVE-2026-60021 - Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not at

CVE-2026-60018 - Gitea's OneDev migration downloader reads the entire remote version response into memory without a s

CVE-2026-60010 - Gitea's repository-side team-link API allows a repository administrator who is not an organization o

CVE-2026-60008 - Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS clas

CVE-2026-59774 - Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endp

CVE-2026-59766 - Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permiss

CVE-2026-53613 - util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 thr

CVE-2026-53612 - util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 thr

CVE-2026-25946 - When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requ

CVE-2026-15176 - A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses t

CVE-2026-110650 - The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_

CVE-2026-110649 - Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execut

CVE-2026-110648 - @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows at

CVE-2026-110647 - Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to exec

CVE-2026-110646 - Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows

CVE-2026-110645 - Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attacker

CVE-2026-110644 - nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() th

CVE-2026-110643 - transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers

CVE-2026-110642 - xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that al

CVE-2026-110641 - @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allo

CVE-2026-110640 - Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to e

CVE-2026-110639 - @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to

CVE-2026-110638 - doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to exec

CVE-2026-110637 - buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows

CVE-2026-110636 - pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(

CVE-2026-110635 - webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js h

CVE-2026-110634 - git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execut

CVE-2026-110633 - MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-p

CVE-2026-110632 - Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 t

CVE-2026-110631 - Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that all

CVE-2026-110630 - VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user mana

CVE-2026-110629 - VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows aut

CVE-2026-110628 - Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the

CVE-2026-110627 - ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_ar

CVE-2026-110626 - ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_ar

CVE-2026-110625 - ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_ar

CVE-2026-110624 - Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticat

CVE-2026-110623 - Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API

CVE-2026-110622 - Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticat

CVE-2026-110621 - Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addPr

CVE-2026-110620 - Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetS

CVE-2026-110619 - frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticate

CVE-2026-110618 - SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP ser

CVE-2026-110617 - we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/expor

CVE-2026-110616 - NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticate

CVE-2026-110615 - jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus e

CVE-2026-110614 - Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support

CVE-2026-110613 - youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authen

CVE-2026-110612 - vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated atta

CVE-2026-110611 - REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 end

CVE-2026-110610 - ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-modu

CVE-2026-110609 - Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authe

CVE-2026-110608 - BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerabilit

CVE-2026-110607 - BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that

CVE-2026-110606 - LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds re

CVE-2026-110605 - libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash app

CVE-2026-110604 - Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when

CVE-2026-110603 - LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows atta

CVE-2026-110602 - libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in

CVE-2026-110601 - libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability

CVE-2026-110600 - xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_

CVE-2026-110599 - L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_s

CVE-2026-110598 - Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value(

CVE-2026-110597 - Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFro

CVE-2026-110596 - quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/i

CVE-2026-110595 - BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_uplo

CVE-2026-110594 - BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that all

CVE-2026-110593 - BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email C

CVE-2026-110592 - BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template()

CVE-2026-110591 - OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analy

CVE-2026-110270 - OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons

CVE-2026-110263 - OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseTyp

CVE-2026-110262 - OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons Adv

CVE-2026-110261 - OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust

CVE-2026-110260 - OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.compute

CVE-2026-110259 - OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmIn

CVE-2026-110258 - OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutine

CVE-2026-110257 - OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBoo

CVE-2026-107381 - svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/Eleme

CVE-2026-104939 - Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy fo

CVE-2026-101895 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-101025 - Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxm

CVE-2026-101019 - Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backe

CVE-2025-71433 - Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to

CVE-2024-58392 - PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() tha

CVE-2020-37282 - office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers

CVE-2020-37281 - Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows

CVE-2017-20286 - DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows

CVE-2016-20099 - L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/v

CVE-2026-98431 - In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmap_lock/disa

CVE-2026-98430 - In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues ali

CVE-2026-98429 - In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources ali

CVE-2026-98428 - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedde

CVE-2026-98427 - In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dro

CVE-2026-98426 - In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak usi

CVE-2026-98425 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when