CVE-2026-16905 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti

CVE-2026-16879 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass securit

CVE-2026-16708 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information

CVE-2026-73679 - ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module th

CVE-2026-73678 - MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution

CVE-2026-50029 - js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a ke

CVE-2026-50027 - mcp-memory-service is a semantic memory layer for AI applications. Prior to 10.67.1, all HTTP routes

CVE-2026-49457 - erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not au

CVE-2026-45699 - Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.

CVE-2026-19188 - A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gate

CVE-2026-18403 - LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Cent

CVE-2025-7639 - The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Opera

CVE-2026-73850 - Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vul

CVE-2026-73849 - Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=r

CVE-2026-73847 - Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on t

CVE-2026-72970 - Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exe

CVE-2026-63361 - LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerab

CVE-2026-49282 - Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name(

CVE-2026-49263 - Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend a

CVE-2026-48528 - Metacat is data repository software that helps researchers preserve, share, and discover data. Metac

CVE-2026-19847 - A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi

CVE-2026-19846 - A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function s

CVE-2026-19682 - A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker

CVE-2026-19681 - An authenticated command injection vulnerability exists in Security Center related to file upload pr

CVE-2026-19680 - A SQL injection vulnerability exists in Security Center that could allow an attacker to access unaut

CVE-2026-19679 - An input validation vulnerability exists in Security Center's file upload handling, where insufficie

CVE-2026-19639 - An improper access control vulnerability exists where an authenticated non-administrative applicatio

CVE-2026-19636 - An issue was identified in which CSRF tokens were generated using a predictable method, potentially

CVE-2026-19635 - A local privilege escalation vulnerability exists in Security Center. An attacker with write access

CVE-2026-19631 - A SQL injection vulnerability exists in Security Center that could allow an authenticated administra

CVE-2026-19629 - A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Secu

CVE-2026-12366 - Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an

CVE-2026-12365 - A use-after-free exists in the Zephyr second-generation work queue (kernel/work.c) in the handling o

CVE-2026-12364 - The user-space system-call verifier z_vrfy_z_log_msg_static_create() in subsys/logging/log_msg.c was

CVE-2026-12363 - The LoRaWAN Fragmented Data Block Transport service (subsys/lorawan/services/frag_transport.c) does

CVE-2026-73846 - CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams

CVE-2026-73845 - CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckan_get_mqa_qu

CVE-2026-73844 - CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect

CVE-2026-73107 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-49989 - CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can

CVE-2026-49986 - The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to vers

CVE-2026-49826 - Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker

CVE-2026-47766 - crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's defau

CVE-2026-47192 - kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, ka

CVE-2026-47191 - kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git c

CVE-2026-46603 - VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing

CVE-2026-46439 - compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 a

CVE-2026-46380 - compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a

CVE-2026-19845 - A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function s

CVE-2026-19844 - A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the func

CVE-2026-19841 - A flaw has been found in TRENDNET TEW-813DRU 1.01b01. Impacted is an unknown function of the file /e

CVE-2026-19839 - A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue aff

CVE-2026-19838 - A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects

CVE-2026-19628 - A command injection vulnerability exists in Tenable Security Center. An authenticated administrator

CVE-2026-19626 - A remote code execution vulnerability exists in Tenable Security Center's report generation function

CVE-2023-7347 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-66272 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for C

CVE-2026-66271 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File

CVE-2026-66270 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File

CVE-2026-63702 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credential

CVE-2026-63701 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of

CVE-2026-63700 - Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permissio

CVE-2026-57472 - Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Director

CVE-2026-57471 - Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Director

CVE-2026-57469 - Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the we

CVE-2026-53970 - ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby

CVE-2026-19884 - In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integra

CVE-2026-19837 - A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the fi

CVE-2026-19836 - A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some un

CVE-2026-19835 - A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an u

CVE-2026-19834 - A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the

CVE-2026-16772 - In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to

CVE-2026-13198 - Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper

CVE-2026-13197 - Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper

CVE-2026-13196 - Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image ma

CVE-2026-13002 - A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An at

CVE-2026-69101 - Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authen

CVE-2026-58224 - A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integri

CVE-2026-19880 - Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows

CVE-2026-19879 - A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `wri

CVE-2026-73633 - Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an applica

CVE-2026-53472 - A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialU

CVE-2026-1621 - Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality al

CVE-2026-19871 - Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.

CVE-2026-19830 - A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an un

CVE-2026-19829 - A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability

CVE-2026-19828 - A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown

CVE-2026-19827 - A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStrea

CVE-2026-19768 - Improper control of generation of code ('Code Injection') in the settings feature in Devolutions Pow

CVE-2026-73673 - Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability tha

CVE-2026-19870 - Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM b

CVE-2026-19826 - A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian

CVE-2026-19825 - A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. Th

CVE-2026-19824 - A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element i

CVE-2026-19823 - A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the f

CVE-2026-73630 - SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFileP

CVE-2026-73051 - actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 pa

CVE-2026-73049 - SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeVie

CVE-2026-73048 - SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFile

CVE-2026-72859 - Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment uplo

CVE-2026-72838 - FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-

CVE-2026-72837 - File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook aut

CVE-2026-72836 - FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home dire

CVE-2026-72835 - filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allo

CVE-2026-72834 - filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum

CVE-2026-72833 - The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege es

CVE-2026-72832 - Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the S

CVE-2026-72831 - The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization

CVE-2026-72830 - Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-

CVE-2026-72829 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in

CVE-2026-72828 - Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in Invit

CVE-2026-72827 - Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action param

CVE-2026-72826 - The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly create

CVE-2026-72825 - The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /r

CVE-2026-72824 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in

CVE-2026-72823 - The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in

CVE-2026-72822 - The getgrav/grav-plugin-api Composer package before 1.0.13 (affected <= 1.0.12) fails to enforce API

CVE-2026-72821 - Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio

CVE-2026-72820 - Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers

CVE-2026-72819 - Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin set

CVE-2026-72817 - go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middlewar

CVE-2026-72816 - go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/

CVE-2026-72815 - go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP mid

CVE-2026-72814 - The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerabi

CVE-2026-72813 - actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range hea

CVE-2026-72812 - SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshB

CVE-2026-72811 - SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query

CVE-2026-72810 - SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast

CVE-2026-19822 - A vulnerability was identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. This issue affects the

CVE-2025-71405 - chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware

CVE-2026-19821 - A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the

CVE-2026-19815 - A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is th

CVE-2026-19814 - A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setM

CVE-2026-19813 - A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts th

CVE-2026-19812 - A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function U

CVE-2026-19794 - The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to

CVE-2026-19811 - A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element i

CVE-2026-19617 - A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) met

CVE-2026-18039 - The Essential Addons for Elementor WordPress plugin before 6.7.2 does not prevent user-supplied reg

CVE-2026-16810 - The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugi

CVE-2026-16739 - The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-c

CVE-2026-15205 - The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplie

CVE-2026-14290 - The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute v

CVE-2026-12949 - The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verifica

CVE-2026-12743 - The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vul

CVE-2026-19792 - A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapp

CVE-2026-19791 - A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addS

CVE-2025-10308 - The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all ver

CVE-2026-19790 - A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPo

CVE-2026-19789 - A vulnerability was determined in Tenda AC1206 15.03.06.23_multi_TD01. This vulnerability affects th

CVE-2026-19788 - A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_devi

CVE-2026-19787 - A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unk

CVE-2026-19786 - A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown

CVE-2026-19785 - A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affect

CVE-2026-19784 - A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate o

CVE-2026-18109 - The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Aut

CVE-2026-19771 - A vulnerability was identified in Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA. This impacts an unknown fun

CVE-2026-19770 - A vulnerability was identified in feedmob fm-mcp-servers 0.0.3. Affected by this vulnerability is th

CVE-2026-19767 - A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects so

CVE-2026-19765 - A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec8059361

CVE-2026-19764 - A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up

CVE-2026-19763 - A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUt

CVE-2026-19762 - A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Pat

CVE-2026-19761 - A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOri

CVE-2026-19758 - A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown p

CVE-2026-19757 - A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown cod

CVE-2026-3883 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-19756 - A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of t

CVE-2026-19753 - A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the funct

CVE-2026-18532 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-73843 - OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, i

CVE-2026-73842 - OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and

CVE-2026-73841 - OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, i

CVE-2026-73840 - OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and

CVE-2026-73667 - OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and

CVE-2026-73666 - OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo

CVE-2026-73665 - FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses i

CVE-2026-73664 - FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in B

CVE-2026-73663 - FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall modul

CVE-2026-73662 - FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits

CVE-2026-73661 - FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits

CVE-2026-73660 - FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module al

CVE-2026-73659 - Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.

CVE-2026-73658 - Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4

CVE-2026-73657 - Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4

CVE-2026-73489 - Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause

CVE-2026-73479 - dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the

CVE-2026-73428 - Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix

CVE-2026-73421 - NextAuth.js provides authentication for Next.js. From next-auth 5.0.0-beta.0 until 5.0.0-beta.32, ap

CVE-2026-73420 - NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 an

CVE-2026-73417 - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup

CVE-2026-73416 - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup

CVE-2026-73408 - Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mys

CVE-2026-73305 - Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal

CVE-2026-73304 - Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api

CVE-2026-73302 - Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-co

CVE-2026-73039 - streama contains an insecure direct object reference vulnerability in ViewingStatusController that a

CVE-2026-72857 - Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowin

CVE-2026-72856 - Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/globa

CVE-2026-72855 - Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import

CVE-2026-72853 - Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's p

CVE-2026-72851 - Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered

CVE-2026-72850 - Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to

CVE-2026-72849 - Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff

CVE-2026-72842 - luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated Lu

CVE-2026-72841 - luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowin

CVE-2026-72840 - OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants writ

CVE-2026-72839 - filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is ena

CVE-2026-72776 - AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that al

CVE-2026-56865 - A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a request

CVE-2026-56864 - A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transpa

CVE-2026-56862 - Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of wheth

CVE-2026-56860 - Previously, resolving relative paths containing parent directory ('..') segments performed string co

CVE-2026-56859 - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to

CVE-2026-56858 - Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled d

CVE-2026-56853 - When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connec

CVE-2026-33818 - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recur

CVE-2026-19752 - A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477

CVE-2026-19751 - A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9

CVE-2026-19750 - A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue

CVE-2026-8715 - Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfi

CVE-2026-73480 - gdu fails to strip terminal escape sequences from directory and file names when printing paths after

CVE-2026-19749 - A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C

CVE-2026-19748 - A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3

CVE-2026-19483 - IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in l

CVE-2026-19297 - IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to

CVE-2026-18741 - Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the

CVE-2026-18715 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-18671 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server threa

CVE-2026-18511 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based bu

CVE-2026-18509 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation

CVE-2026-18249 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges

CVE-2026-18193 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to im

CVE-2026-18101 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to imprope

CVE-2026-18086 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denia

CVE-2026-18077 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a sta

CVE-2026-18068 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a

CVE-2026-18020 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an of

CVE-2026-17649 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an

CVE-2026-17502 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an ou

CVE-2026-17482 - IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17481 - IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary cod

CVE-2026-17476 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an im

CVE-2026-17473 - IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files

CVE-2026-17468 - IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session t

CVE-2026-17438 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify

CVE-2026-17272 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buf

CVE-2026-17226 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-17216 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an in

CVE-2026-17212 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an ou