CVE-2026-94678 - Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

CVE-2026-94677 - Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

CVE-2026-94674 - Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.

CVE-2026-94673 - Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.3

CVE-2026-94672 - Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.

CVE-2026-94499 - Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

CVE-2026-94389 - Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

CVE-2026-94178 - Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.

CVE-2026-94177 - Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.

CVE-2026-94173 - Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

CVE-2026-94123 - Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

CVE-2026-94122 - Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

CVE-2026-94121 - Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed o

CVE-2026-94120 - Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

CVE-2026-94115 - Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

CVE-2026-94082 - Author SQL Injection in Quiz Cat <= 3.1.1 versions.

CVE-2026-94081 - Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

CVE-2026-94078 - Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

CVE-2026-94077 - Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

CVE-2026-94076 - Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

CVE-2026-94074 - Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

CVE-2026-93771 - Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

CVE-2026-93770 - Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

CVE-2026-93651 - Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

CVE-2026-93624 - Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

CVE-2026-93621 - Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

CVE-2026-93514 - Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

CVE-2026-93512 - Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

CVE-2026-92899 - Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reu

CVE-2026-92121 - In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves

CVE-2026-89238 - WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the

CVE-2026-86778 - Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and

CVE-2026-76504 - A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager

CVE-2026-74865 - sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the passwo

CVE-2026-74864 - sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-rem

CVE-2026-62085 - Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

CVE-2026-62083 - Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

CVE-2026-62081 - Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

CVE-2026-62080 - Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

CVE-2026-62079 - Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

CVE-2026-62078 - Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

CVE-2026-27371 - Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVE-2026-27085 - Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

CVE-2026-103321 - MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. Th

CVE-2026-103117 - A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the funct

CVE-2026-103116 - A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery

CVE-2026-103115 - A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown func

CVE-2026-102399 - Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.

CVE-2026-102398 - Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.

CVE-2026-102396 - Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.

CVE-2026-102395 - Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

CVE-2026-102386 - Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.

CVE-2026-102385 - Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

CVE-2026-102384 - Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

CVE-2026-100513 - Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Fo

CVE-2026-100508 - Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.

CVE-2026-100507 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-88920 - An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote

CVE-2026-87830 - In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions

CVE-2026-85532 - Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. T

CVE-2026-62146 - A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata t

CVE-2026-10739 - Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files wit

CVE-2026-10726 - Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A

CVE-2026-103242 - A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM

CVE-2026-103114 - A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the funct

CVE-2026-103012 - Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or writt

CVE-2026-96342 - Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Se

CVE-2026-76992 - The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enfo

CVE-2026-13720 - An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and g

CVE-2026-13719 - An authenticated user can list alert rules stored in folders they are not allowed to read through th

CVE-2026-103239 - MISP contains a privilege escalation vulnerability in the tag collection creation and editing functi

CVE-2026-103113 - A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the funct

CVE-2026-94053 - Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 t

CVE-2026-94052 - A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2

CVE-2026-94029 - Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, componen

CVE-2026-94002 - Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA

CVE-2026-93996 - Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or

CVE-2026-93995 - Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0

CVE-2026-93994 - Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configure

CVE-2026-79625 - Affected products do not properly synchronize access to their monitoring functionality. When multipl

CVE-2026-77185 - Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.

CVE-2026-10764 - Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain u

CVE-2026-103237 - MISP contains an improper input validation vulnerability in its ORM save path. When a user submits d

CVE-2026-103235 - MISP contains a mass assignment vulnerability in the event delegation feature. When a user with dele

CVE-2026-97347 - The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via U

CVE-2026-93908 - The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable t

CVE-2026-92712 - The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-S

CVE-2026-75098 - The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions u

CVE-2026-102588 - A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CS

CVE-2026-102587 - A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on use

CVE-2026-102586 - A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page a

CVE-2026-102585 - A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the

CVE-2026-102584 - A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user c

CVE-2026-102583 - A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor

CVE-2026-102582 - A flaw was found in Moodle. The manual enrolment management page did not properly check whether the

CVE-2026-102581 - A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts en

CVE-2026-102580 - A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience cl

CVE-2026-102579 - A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authent

CVE-2026-102578 - A flaw was found in Moodle. An authenticated attacker with access to the question bank web service c

CVE-2026-102577 - A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL download

CVE-2026-102511 - Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementa

CVE-2026-102510 - Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation w

CVE-2026-102509 - Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolle

CVE-2026-102459 - EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticat

CVE-2026-102458 - EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remot

CVE-2026-102457 - EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote at

CVE-2026-102456 - EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attacker

CVE-2026-102455 - EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated rem

CVE-2026-102454 - EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote att

CVE-2025-14564 - The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-97150 - When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.ph

CVE-2026-93464 - A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If t

CVE-2026-93463 - A cross-site scripting vulnerability via script validation bypass exists in baserCMS. If this vulner

CVE-2026-93462 - A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerabili

CVE-2026-93460 - A stored cross-site scripting vulnerability via appended strings in email form fields exists in base

CVE-2026-92873 - Pgpool-II contains an incorrect implementation of an authentication algorithm, which may allow an un

CVE-2026-92872 - Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to

CVE-2026-92871 - A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated att

CVE-2026-92870 - A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated

CVE-2026-92869 - An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker

CVE-2026-92868 - An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthentic

CVE-2026-92867 - An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker

CVE-2026-88037 - The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `tit

CVE-2026-6806 - The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-

CVE-2026-6173 - The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bac

CVE-2026-6172 - The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cap

CVE-2026-6171 - The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tar

CVE-2026-6170 - The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ima

CVE-2026-16596 - The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_field

CVE-2026-14876 - The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-h

CVE-2026-11895 - The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vuln

CVE-2026-102508 - Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA d

CVE-2026-97196 - Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP al

CVE-2026-89294 - The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all v

CVE-2026-97316 - The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of red

CVE-2026-96886 - The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking expo

CVE-2026-94297 - The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user

CVE-2026-94274 - The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns

CVE-2026-93580 - The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment we

CVE-2026-92994 - The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents

CVE-2026-92424 - The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content

CVE-2026-91832 - The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings

CVE-2026-91072 - The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migra

CVE-2026-91051 - The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with aut

CVE-2026-90953 - The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on

CVE-2026-89193 - The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTM

CVE-2026-89190 - The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities befo

CVE-2026-88797 - The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX act

CVE-2026-88791 - The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect dest

CVE-2026-87777 - The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting bef

CVE-2026-86789 - The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility an

CVE-2026-85576 - The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and d

CVE-2026-85573 - The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload typ

CVE-2026-85415 - The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplie

CVE-2026-85001 - The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widg

CVE-2026-83560 - The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set

CVE-2026-82127 - The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability

CVE-2026-80333 - The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status che

CVE-2026-75873 - The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one o

CVE-2026-75824 - The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user regist

CVE-2026-75823 - The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned

CVE-2026-100143 - The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person

CVE-2026-103111 - PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usag

CVE-2026-102913 - A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impa

CVE-2026-86134 - A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows

CVE-2026-103110 - Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that

CVE-2026-102912 - A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affe

CVE-2026-102911 - A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the fi

CVE-2026-102910 - A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The aff

CVE-2026-96649 - The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress i

CVE-2026-86556 - There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control,

CVE-2026-103109 - Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in th

CVE-2026-103108 - Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in t

CVE-2026-103106 - Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation with

CVE-2026-103105 - Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a pr

CVE-2026-103104 - Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in th

CVE-2026-103102 - Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation

CVE-2026-103101 - Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web ser

CVE-2026-103100 - Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation

CVE-2026-103099 - Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that

CVE-2026-102909 - A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is

CVE-2026-102908 - A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue a

CVE-2026-102906 - A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66eac1726fce02ca7bb5a638

CVE-2026-102874 - A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of th

CVE-2026-81310 - Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in t

CVE-2026-78229 - Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can l

CVE-2026-103088 - Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, th

CVE-2026-103087 - Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before comm

CVE-2026-102847 - A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76

CVE-2026-102846 - A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44c

CVE-2026-102845 - A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a38870

CVE-2026-102844 - A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d4

CVE-2026-102843 - A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915

CVE-2026-51936 - Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can

CVE-2026-103057 - AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime se

CVE-2026-103056 - AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service

CVE-2026-103055 - AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime We

CVE-2026-103054 - AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that a

CVE-2026-103053 - AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoin

CVE-2026-102842 - A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d4

CVE-2026-102805 - A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/st

CVE-2026-102804 - A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The imp

CVE-2026-90441 - A missing authorization vulnerability in the wgagent management daemon's session initialization func

CVE-2026-86136 - A missing authorization vulnerability in the wgagent management daemon's session initialization func

CVE-2026-86133 - An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote a

CVE-2026-86132 - An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote

CVE-2026-86131 - A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handl

CVE-2026-86128 - A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a

CVE-2026-86105 - An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authe

CVE-2026-86104 - An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows

CVE-2026-86101 - An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remo

CVE-2026-81433 - A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (

CVE-2026-18145 - A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Firewar

CVE-2026-18105 - An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows

CVE-2026-13224 - A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated adm

CVE-2026-13046 - A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on se

CVE-2026-103051 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103050 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103049 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103048 - URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediaw

CVE-2026-102794 - A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown proces

CVE-2026-102793 - A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_tim

CVE-2026-15278 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-103047 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103046 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103045 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-103044 - XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - Easy

CVE-2026-103043 - anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 hos

CVE-2026-103042 - LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when s

CVE-2026-103041 - LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pick

CVE-2026-103040 - LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service

CVE-2026-102792 - A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of

CVE-2026-91191 - The device's update mechanism includes conditions that allow unauthorized software packages to be ac

CVE-2026-84409 - The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP conne

CVE-2026-74225 - U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails t

CVE-2026-74222 - U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function wi

CVE-2026-74221 - U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-com

CVE-2026-74220 - U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.

CVE-2026-72510 - The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-bas

CVE-2026-72507 - The "reportType" parameter in the product summary report feature within the balancing reports sectio

CVE-2026-71974 - U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition()

CVE-2026-71973 - U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table()

CVE-2026-71972 - U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_b

CVE-2026-71971 - U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerabilit

CVE-2026-71379 - The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by

CVE-2026-71302 - The application accepts user-supplied session identifiers and does not regenerate the session ID aft

CVE-2026-71189 - An attacker can construct a request that, if issued by another application user, will cause JavaScri

CVE-2026-70356 - The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attack

CVE-2026-69662 - The application uses unsafe functions that allow execution of inline scripts and string evaluation f

CVE-2026-68954 - The "pattern" parameter used in search function in the home page of the TMS application is vulnerabl