CVE-2026-104451 - YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that al

CVE-2026-104450 - YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/ac

CVE-2026-104449 - YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to

CVE-2026-104448 - YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handl

CVE-2026-104447 - YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAct

CVE-2026-104446 - YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows

CVE-2026-104445 - YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that f

CVE-2026-104444 - YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment

CVE-2026-104443 - YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any

CVE-2026-104442 - YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allo

CVE-2026-104441 - YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allo

CVE-2026-104440 - YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthen

CVE-2026-104439 - YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows

CVE-2026-104438 - YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includep

CVE-2026-104437 - Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verific

CVE-2026-104436 - Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2

CVE-2026-104435 - Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 tra

CVE-2026-104434 - ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion i

CVE-2026-104432 - Zebra before 6.3.0 contains an improper exceptional condition check in ChainSync::obtain_tips that d

CVE-2026-104431 - Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to s

CVE-2026-104430 - Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mo

CVE-2026-104429 - Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transact

CVE-2026-104428 - The getblock RPC method in zebra-rpc before 11.0.0, used by the Zcash Foundation's Zebra node, panic

CVE-2026-104427 - Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows

CVE-2026-104426 - Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transac

CVE-2026-104425 - ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthen

CVE-2026-104424 - Zebra before 6.1.0 contains an incorrect calculation vulnerability in its ZIP-317 block template sel

CVE-2026-104423 - Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows un

CVE-2026-104422 - The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalida

CVE-2026-104421 - Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to

CVE-2026-104420 - Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to evad

CVE-2026-104419 - Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks respon

CVE-2026-104418 - Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authentic

CVE-2026-104417 - Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file lo

CVE-2026-104416 - Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API th

CVE-2026-104415 - Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API tha

CVE-2026-104414 - Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows atta

CVE-2026-104413 - Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta

CVE-2026-104412 - Ghost 0.5.0 before 6.64.0 does not correctly restrict staff role assignment, allowing users with the

CVE-2026-104411 - Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta

CVE-2026-104410 - SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to

CVE-2026-103763 - SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish

CVE-2026-103762 - SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, get

CVE-2026-97876 - A local attacker with control over GRUB's configuration can bypass lockdown restrictions when bootin

CVE-2026-96990 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings.

CVE-2026-94651 - improper handling of exceptional conditions, Missing release of resource after effective lifetime vu

CVE-2026-94650 - Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache

CVE-2026-94645 - Improper validation of specified quantity in input, Allocation of resources without limits or thrott

CVE-2026-94644 - Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings.

CVE-2026-94642 - Uncaught exception vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift:

CVE-2026-94633 - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vul

CVE-2026-93926 - Missing release of memory after effective lifetime, Missing release of resource after effective life

CVE-2026-93925 - Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ T

CVE-2026-91137 - Improper validation of specified quantity in input, Allocation of resources without limits or thrott

CVE-2026-91135 - Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. When an applicati

CVE-2026-86326 - An improper verification of cryptographic signature vulnerability exists in protocol gateways becaus

CVE-2026-86325 - A stack-based buffer overflow vulnerability exists in protocol gateways' account management interfac

CVE-2026-85494 - Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Com

CVE-2026-85493 - Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affec

CVE-2026-85483 - Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bin

CVE-2026-59668 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59667 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59666 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-104606 - A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacte

CVE-2026-97652 - The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vu

CVE-2026-95662 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-94639 - improper handling of exceptional conditions, Allocation of resources without limits or throttling, U

CVE-2026-94635 - Allocation of resources without limits or throttling, Improper handling of length parameter inconsis

CVE-2026-94634 - Allocation of resources without limits or throttling, Initialization of a resource with an insecure

CVE-2026-94541 - The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization b

CVE-2026-94405 - Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows R

CVE-2026-94180 - Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows R

CVE-2026-87920 - The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con

CVE-2026-85492 - The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO

CVE-2026-80298 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-59673 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59672 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59665 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59664 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59663 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59662 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59661 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59660 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59659 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-104403 - Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploi

CVE-2026-103885 - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using t

CVE-2026-103880 - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password us

CVE-2026-103878 - Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A Sta

CVE-2026-103877 - Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised

CVE-2026-103552 - Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a de

CVE-2026-102731 - Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicio

CVE-2026-95512 - A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could explo

CVE-2026-91784 - cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The p

CVE-2026-80464 - Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows S

CVE-2026-80443 - Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adve

CVE-2026-80337 - Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Func

CVE-2026-59671 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59670 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-59669 - Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulne

CVE-2026-97663 - The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti

CVE-2026-97641 - The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

CVE-2026-97637 - The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Coo

CVE-2026-97634 - The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via t

CVE-2026-97342 - The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-

CVE-2026-97338 - The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display N

CVE-2026-97336 - The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Typ

CVE-2026-96871 - The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type'

CVE-2026-96647 - The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul

CVE-2026-96578 - The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross

CVE-2026-96567 - The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' p

CVE-2026-96566 - The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cro

CVE-2026-95817 - The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comm

CVE-2026-95670 - The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL

CVE-2026-94432 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-93880 - The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected C

CVE-2026-93756 - The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulne

CVE-2026-63578 - Allocation of resources without limits in password-based private-key decryption (PbeUtilities.Genera

CVE-2026-63577 - Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValida

CVE-2026-63576 - Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the

CVE-2026-63575 - Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Le

CVE-2026-63574 - Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket pa

CVE-2026-63573 - Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation

CVE-2026-63572 - Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of t

CVE-2026-63571 - Improper verification of cryptographic signature in the attribute certificate path validator (PkixAt

CVE-2026-63570 - Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Cast

CVE-2026-18036 - In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpe

CVE-2026-17508 - In Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KD

CVE-2026-17507 - In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420'

CVE-2026-12951 - The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_b

CVE-2026-103604 - Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString

CVE-2026-103603 - Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, H

CVE-2026-103602 - Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. b

CVE-2026-103601 - Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD

CVE-2026-103600 - Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Boun

CVE-2026-103426 - The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_r

CVE-2026-102772 - The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code f

CVE-2026-102002 - The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is

CVE-2026-100182 - The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Ori

CVE-2026-100107 - The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

CVE-2026-97219 - The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer

CVE-2026-93698 - Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

CVE-2026-93697 - There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Account

CVE-2026-93029 - There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts in

CVE-2026-92924 - The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to

CVE-2026-91020 - The WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supp

CVE-2026-90987 - The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment am

CVE-2026-90952 - The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access r

CVE-2026-85005 - The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several o

CVE-2026-84740 - The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to

CVE-2026-79618 - The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requi

CVE-2026-63569 - Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legi

CVE-2026-63568 - Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PK

CVE-2026-63567 - Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp befor

CVE-2026-63566 - Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake,

CVE-2026-1661 - The WP Mail Logging WordPress plugin before 1.17.0 does not properly restrict the HTML and CSS of lo

CVE-2026-16001 - Exposure of the message authentication key through the encryption keystream in the stream mode of Ie

CVE-2026-16000 - Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of t

CVE-2026-15999 - Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlo

CVE-2026-13413 - The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict acces

CVE-2026-102565 - The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bo

CVE-2026-97318 - The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validat

CVE-2026-97317 - The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAP

CVE-2026-94298 - The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by

CVE-2026-92820 - The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in al

CVE-2026-92174 - The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all vers

CVE-2026-91828 - The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not

CVE-2026-91023 - The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to mo

CVE-2026-91022 - The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting bef

CVE-2026-90988 - The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one o

CVE-2026-90438 - The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to

CVE-2026-85016 - The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value be

CVE-2026-85004 - The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its ac

CVE-2026-84925 - The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflect

CVE-2026-81740 - The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genui

CVE-2026-78471 - The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author

CVE-2026-15897 - The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio

CVE-2026-15896 - The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal

CVE-2026-13718 - The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce produ

CVE-2026-19660 - The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up t

CVE-2026-10026 - The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and inc

CVE-2026-93367 - The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated

CVE-2026-14378 - The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator

CVE-2026-104123 - A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by th

CVE-2026-104120 - A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-e

CVE-2026-21140 - Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attacker

CVE-2026-104480 - Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster c

CVE-2026-104054 - A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUse

CVE-2026-104053 - A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element

CVE-2026-104052 - A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element

CVE-2026-103098 - Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent

CVE-2026-103097 - An API key is hardcoded and retrievable from the application package. Since Android applications can

CVE-2026-103096 - API key is hardcoded and retrievable from the application package. Since Android applications can be

CVE-2026-86345 - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a

CVE-2026-103766 - ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated u

CVE-2026-103765 - Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata s

CVE-2026-103764 - Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::r

CVE-2026-103761 - Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in Transfer

CVE-2026-103760 - Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows

CVE-2025-71427 - Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP c

CVE-2026-86344 - A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operati

CVE-2026-71454 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-71453 - - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - trave

CVE-2026-71452 - - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. T

CVE-2026-71449 - : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retriev

CVE-2026-71448 - : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows :

CVE-2026-64893 - - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allow

CVE-2026-64892 - - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Dat

CVE-2026-51897 - RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending

CVE-2026-51896 - infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). De

CVE-2026-51895 - Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_ap

CVE-2026-51894 - infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable pat

CVE-2026-51893 - infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally

CVE-2026-51892 - infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/<doc_id>.

CVE-2026-51888 - langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write

CVE-2026-51886 - langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (r

CVE-2026-51884 - The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1

CVE-2026-51883 - The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vuln

CVE-2026-51882 - The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to

CVE-2026-51881 - deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket int

CVE-2026-51880 - deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot W

CVE-2026-51879 - deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in Tuto

CVE-2026-51878 - deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in Turn

CVE-2026-51876 - DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An una

CVE-2026-51875 - In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerabil

CVE-2026-51874 - In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerabil

CVE-2026-51873 - Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which a

CVE-2026-34494 - - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from

CVE-2026-34493 - - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Com

CVE-2026-27873 - - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Sprayin

CVE-2026-18397 - This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by expl

CVE-2026-104356 - PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString()

CVE-2026-104051 - PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated

CVE-2026-104002 - A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Pytho

CVE-2026-96780 - figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Pr

CVE-2026-71451 - - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. Th

CVE-2026-55396 - Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP

CVE-2026-55395 - Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot)

CVE-2026-55394 - Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows ad

CVE-2026-55393 - Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot

CVE-2026-27874 - : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation

CVE-2026-104183 - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal mem

CVE-2026-104182 - stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal mem

CVE-2026-104181 - Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un

CVE-2026-104020 - Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote una

CVE-2026-102514 - Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of th

CVE-2026-102370 - Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or

CVE-2026-93832 - A component of one of the Motorola system applications was exported without permission, allowing for

CVE-2026-82358 - RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service Data Object) server

CVE-2026-82357 - RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configu

CVE-2026-71542 - GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of