CVE-2026-102722 - In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply.

CVE-2026-102721 - A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the

CVE-2026-102720 - A DHCP server, or anyone on the LAN who answers a DISCOVER first, can make the client read about a

CVE-2026-102719 - Predictable DTLS HelloVerifyRequest Cookie in NetX Secure

CVE-2026-102718 - hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OI

CVE-2026-102716 - An unauthenticated client can drain the RTSP server's packet pool with a couple of dozen requests

CVE-2026-102715 - Any host on the LAN can send two mDNS records and make the responder write past the end of its tr

CVE-2026-102714 - `_nx_icmpv6_validate_options()` scans the option area with `while (length > 2)` (`common/src/nx_icmp

CVE-2026-102713 - The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than

CVE-2026-102712 - On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates th

CVE-2026-102711 - Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled

CVE-2026-102710 - Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION` modul

CVE-2026-102709 - Improper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC) en

CVE-2026-102677 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-102639 - MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary

CVE-2026-102560 - A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large

CVE-2026-102559 - A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outg

CVE-2026-102558 - A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnectio

CVE-2026-102555 - A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data

CVE-2026-102242 - Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP To

CVE-2026-92232 - Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTM

CVE-2026-92231 - Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch

CVE-2026-92227 - Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.

CVE-2026-92226 - Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.

CVE-2026-92225 - Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The modul

CVE-2026-92224 - Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - T

CVE-2026-92223 - Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.

CVE-2026-92222 - Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.

CVE-2026-90918 - Joomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - T

CVE-2026-90917 - Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5

CVE-2026-90916 - Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla

CVE-2026-90915 - Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0

CVE-2026-90914 - Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.

CVE-2026-90913 - Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joom

CVE-2026-90907 - Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in

CVE-2026-90906 - Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack

CVE-2026-102796 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-102697 - Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experim

CVE-2026-102676 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-102675 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-102674 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-102673 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-102635 - ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in t

CVE-2026-102634 - SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_ro

CVE-2026-102633 - libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() f

CVE-2026-102623 - A flaw was found in KubeVirt. An authenticated user with permission to create Virtual Machine Instan

CVE-2026-102557 - A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libs

CVE-2026-102556 - A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection

CVE-2026-102425 - Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms

CVE-2026-102424 - Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto

CVE-2026-101127 - Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3

CVE-2026-101126 - Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final for

CVE-2026-101112 - Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - T

CVE-2026-100245 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab

CVE-2026-100244 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med

CVE-2026-100243 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab

CVE-2026-100242 - Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability i

CVE-2026-100241 - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med

CVE-2026-100240 - Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension al

CVE-2026-100238 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab

CVE-2022-51019 - Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation an

CVE-2026-97711 - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expres

CVE-2026-97689 - urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked

CVE-2026-97688 - urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPRe

CVE-2026-97687 - urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_

CVE-2026-93332 - Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier a

CVE-2026-93330 - Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows

CVE-2026-92371 - TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation v

CVE-2026-92370 - An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modul

CVE-2026-92369 - TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in

CVE-2026-92368 - TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer

CVE-2026-84784 - Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames

CVE-2026-84783 - Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause i

CVE-2026-84782 - Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write tha

CVE-2026-77696 - Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming

CVE-2026-77177 - Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other prod

CVE-2026-75806 - Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a

CVE-2026-75805 - Issue summary: A CMP client that requests certificate revocation on the basis of a PKCS#10 CSR may d

CVE-2026-75804 - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote

CVE-2026-72897 - Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_C

CVE-2026-54875 - Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used f

CVE-2026-54873 - Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than neces

CVE-2026-54872 - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature ope

CVE-2026-42772 - Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packet

CVE-2026-35191 - Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be fo

CVE-2026-35189 - Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes dispro

CVE-2026-19743 - Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Lin

CVE-2026-102630 - UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwa

CVE-2026-102601 - Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePat

CVE-2026-102600 - Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @s

CVE-2026-102598 - Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function use

CVE-2026-100308 - Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 mig

CVE-2026-100289 - Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and ear

CVE-2026-100288 - Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earl

CVE-2026-100287 - Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier all

CVE-2026-100286 - Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier a

CVE-2023-54400 - Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that al

CVE-2026-86035 - Weblate is a web-based continuous localization platform used to manage software translations. Weblat

CVE-2026-68911 - Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a mo

CVE-2026-65102 - NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by sup

CVE-2026-63209 - compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow

CVE-2026-49243 - Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webm

CVE-2026-22101 - The access to the service menu is obfuscated, but possible with only physical access. This menu expo

CVE-2026-22094 - The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login

CVE-2026-102570 - ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the lang

CVE-2026-102569 - ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admi

CVE-2026-102568 - Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit

CVE-2026-102567 - CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loade

CVE-2026-102566 - CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails

CVE-2026-102491 - A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. Th

CVE-2026-102371 - In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL in

CVE-2025-33207 - NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF ac

CVE-2015-20122 - Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnera

CVE-2026-97395 - Apache Polaris allows an authenticated principal with permission to create or update Iceberg table p

CVE-2026-86450 - Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Lim

CVE-2026-81569 - An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticat

CVE-2026-78214 - An authentication bypass vulnerability exists in the protection of Actuator endpoints. The applicati

CVE-2026-71899 - A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache Dolp

CVE-2026-71898 - An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only r

CVE-2026-71897 - An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the b

CVE-2026-4034 - Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user t

CVE-2026-102521 - The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it sh

CVE-2026-102360 - A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-r

CVE-2026-98164 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write track

CVE-2026-96869 - Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-82973 - Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox befo

CVE-2026-82804 - The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization

CVE-2026-7193 - A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini-rou

CVE-2026-7192 - A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authe

CVE-2026-76875 - PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat modu

CVE-2026-76114 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext

CVE-2026-73599 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redi

CVE-2026-73598 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrec

CVE-2026-102437 - OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSe

CVE-2026-101271 - OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the applicat

CVE-2026-101270 - Malicious HTML content could be injected into the help texts of various fields with organizer permis

CVE-2026-101269 - The mechanism binding API-uploaded files to the uploader's authentication method is not working corr

CVE-2026-101268 - If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to

CVE-2026-101267 - A missing permission check allowed low-privileged users with access to an event but without access t

CVE-2026-100832 - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100831 - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Fir

CVE-2026-100830 - Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100829 - Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100828 - Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR

CVE-2026-100826 - Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox

CVE-2026-100825 - Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR

CVE-2026-100824 - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thu

CVE-2026-100823 - Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Fi

CVE-2026-100822 - Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100821 - Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox E

CVE-2026-100820 - Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4

CVE-2026-100819 - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was f

CVE-2026-100818 - Sandbox escape due to use-after-free in the Widget: Gtk component. This vulnerability was fixed in F

CVE-2026-100817 - Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 15

CVE-2026-100816 - Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 1

CVE-2026-100815 - Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox

CVE-2026-100814 - Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed

CVE-2026-100813 - Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird

CVE-2026-100812 - Denial-of-service in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thun

CVE-2026-100811 - Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed

CVE-2026-100810 - Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 1

CVE-2026-100809 - Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153

CVE-2026-100808 - Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR

CVE-2026-100807 - Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox

CVE-2026-100806 - Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR

CVE-2026-100805 - Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunder

CVE-2026-100804 - Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was f

CVE-2026-100803 - Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ES

CVE-2026-100802 - Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird

CVE-2026-100801 - Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100800 - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was

CVE-2026-100799 - Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird

CVE-2026-100798 - Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR

CVE-2026-100797 - Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability

CVE-2026-100796 - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird

CVE-2026-100795 - Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and F

CVE-2026-100794 - Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vuln

CVE-2026-100793 - JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 1

CVE-2026-100792 - JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox

CVE-2026-100791 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100790 - Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

CVE-2026-100789 - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100788 - Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ES

CVE-2026-100787 - Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

CVE-2026-100786 - Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Fire

CVE-2026-100785 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100784 - Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR

CVE-2026-100783 - Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4

CVE-2026-100782 - Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerabil

CVE-2026-100781 - Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulne

CVE-2026-100780 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100779 - Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

CVE-2026-100778 - Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed

CVE-2026-100777 - Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100776 - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR

CVE-2026-100775 - Sandbox escape in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunder

CVE-2026-100774 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100773 - Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.

CVE-2026-100772 - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100771 - Undefined behavior in the DOM: Streams component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100770 - Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was

CVE-2026-100769 - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR

CVE-2026-100768 - Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 an

CVE-2026-100767 - Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4

CVE-2026-100766 - Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR

CVE-2026-100765 - Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR

CVE-2026-100764 - Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vu

CVE-2026-100763 - Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thu

CVE-2026-100762 - Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was

CVE-2026-100761 - Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was

CVE-2026-100760 - Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefo

CVE-2026-100759 - Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefo

CVE-2026-100758 - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,

CVE-2026-100757 - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi

CVE-2026-100756 - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed i

CVE-2026-95520 - A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM pack

CVE-2026-87748 - Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Pri

CVE-2026-85520 - Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrar

CVE-2026-73597 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Sit

CVE-2026-73596 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initiali

CVE-2026-73595 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.

CVE-2026-73594 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.

CVE-2026-73593 - Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active D

CVE-2026-66083 - The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An

CVE-2026-41875 - Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can

CVE-2026-102507 - Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the opera

CVE-2026-102497 - The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitutio

CVE-2026-102496 - Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema

CVE-2026-102495 - Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious

CVE-2026-101266 - A logic flaw in the checkout flow allows users to bypass validations performed during the check-in b

CVE-2026-95509 - Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting

CVE-2026-96423 - X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96422 - Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96421 - USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allow

CVE-2026-96420 - Toshiba file parser crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96419 - Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible cod

CVE-2026-96418 - TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96417 - RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96416 - IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96415 - Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of ser

CVE-2026-95395 - IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allo

CVE-2026-95394 - Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial

CVE-2026-95393 - CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-95392 - MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-95391 - ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service

CVE-2026-95390 - PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service

CVE-2026-95389 - SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-95388 - Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-95387 - SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-95386 - TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service