CVE-2026-15390 - Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a c

CVE-2026-11796 - Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, Metad

CVE-2026-10518 - GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 bef

CVE-2026-102474 - A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \

CVE-2026-102473 - A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements

CVE-2026-96440 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/downlo

CVE-2026-96431 - Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoi

CVE-2026-96430 - Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow

CVE-2026-96429 - SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 versi

CVE-2026-96428 - SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 versio

CVE-2026-92142 - Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based a

CVE-2026-91085 - Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.

CVE-2026-91048 - The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard

CVE-2026-91012 - org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "con

CVE-2026-84154 - A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2

CVE-2026-101169 - In affected versions of Octopus Server, an authenticated user with permissions to edit an Environmen

CVE-2026-86158 - Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everyw

CVE-2026-86157 - Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0

CVE-2026-102293 - A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffSer

CVE-2026-102292 - A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec764

CVE-2026-102290 - A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function

CVE-2026-102264 - A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. T

CVE-2026-102263 - A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148

CVE-2026-102261 - A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the fil

CVE-2026-97029 - Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or kill

CVE-2026-97024 - A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deploymen

CVE-2026-102422 - shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comm

CVE-2026-102414 - pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in i

CVE-2026-102249 - A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code

CVE-2026-102248 - A vulnerability was identified in Rebuild up to 4.4.7/4.5.0-beta5. This affects an unknown part of t

CVE-2026-102247 - A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown fun

CVE-2026-102245 - A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknow

CVE-2026-97685 - An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own

CVE-2026-102244 - A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown func

CVE-2026-102243 - A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown p

CVE-2026-102241 - A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unkno

CVE-2026-96326 - The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to S

CVE-2026-102240 - A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the

CVE-2026-101878 - Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUs

CVE-2026-101860 - A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the functio

CVE-2026-101859 - A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability i

CVE-2026-101858 - A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::wri

CVE-2026-101354 - A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the fun

CVE-2026-102374 - GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth

CVE-2026-102373 - GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threa

CVE-2026-102372 - GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connect

CVE-2026-101281 - A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerabilit

CVE-2026-101280 - A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the functi

CVE-2026-101279 - A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This imp

CVE-2026-101278 - A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the fun

CVE-2026-18747 - The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it,

CVE-2026-18746 - parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE

CVE-2026-18417 - The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into str

CVE-2026-102367 - mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh en

CVE-2026-102366 - mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints th

CVE-2026-102365 - mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that

CVE-2026-102364 - mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront cus

CVE-2026-102363 - mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDe

CVE-2026-102362 - mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in Pr

CVE-2026-102361 - mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoi

CVE-2026-101277 - A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted el

CVE-2026-101265 - A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unkno

CVE-2026-101264 - A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the

CVE-2026-101263 - A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing

CVE-2026-102335 - Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, al

CVE-2026-102334 - Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthe

CVE-2026-102333 - httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickab

CVE-2026-102332 - Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive ent

CVE-2026-101262 - A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown cod

CVE-2026-101261 - A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/Z

CVE-2026-101260 - A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown f

CVE-2026-102297 - ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController inde

CVE-2026-102296 - ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetRes

CVE-2026-102281 - Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0

CVE-2026-101205 - A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function

CVE-2026-101204 - A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of t

CVE-2026-101203 - A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unkno

CVE-2026-101202 - A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown functi

CVE-2026-101188 - A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects

CVE-2026-101093 - Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that al

CVE-2026-101092 - SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint

CVE-2026-101091 - SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks e

CVE-2024-58386 - ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view th

CVE-2024-42002 - A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topi

CVE-2026-97027 - Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's De

CVE-2026-97026 - Flatpak creates temporary child repository directories under the user cache with world-writable perm

CVE-2026-97025 - Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the

CVE-2026-91096 - In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (Web

CVE-2026-91095 - In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream a

CVE-2026-84895 - In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its membe

CVE-2026-18416 - The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a re

CVE-2026-18415 - ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single

CVE-2026-18414 - The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small

CVE-2026-18413 - The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small

CVE-2026-16513 - The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/

CVE-2026-102279 - Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages

CVE-2026-102278 - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior

CVE-2026-102277 - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior

CVE-2026-102276 - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior

CVE-2026-102275 - PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgo

CVE-2026-102274 - PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does

CVE-2026-102273 - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWT HMACAl

CVE-2026-102272 - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorith

CVE-2026-102271 - PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlg

CVE-2026-102270 - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT is_pem_format i

CVE-2026-102269 - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT signature segme

CVE-2026-102268 - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/

CVE-2026-102267 - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is

CVE-2026-102266 - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorith

CVE-2026-102265 - PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load

CVE-2026-102006 - In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process man

CVE-2026-102005 - Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configura

CVE-2026-101918 - PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWK

CVE-2026-101917 - PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key

CVE-2026-101916 - @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P

CVE-2026-101187 - A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the functio

CVE-2026-101146 - A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the funct

CVE-2026-101145 - A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects u

CVE-2026-101144 - A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part

CVE-2026-100392 - InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVE-2026-100371 - InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments.

CVE-2026-100370 - DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl

CVE-2026-96760 - Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignat

CVE-2026-93355 - LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT fro

CVE-2026-87741 - The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versi

CVE-2026-86950 - An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS

CVE-2026-102004 - Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption

CVE-2026-101915 - @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P

CVE-2026-101914 - @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P

CVE-2026-101143 - A vulnerability was found in Eleveo Quality Management 9.7.0. Affected by this issue is some unknown

CVE-2026-101142 - A vulnerability has been found in Eleveo Quality Management 9.7.0. Affected by this vulnerability is

CVE-2026-101141 - A flaw has been found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of th

CVE-2026-97686 - Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsyste

CVE-2026-97023 - A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployme

CVE-2026-84894 - In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read hand

CVE-2026-13018 - Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed

CVE-2026-102010 - A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority q

CVE-2026-101139 - A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown func

CVE-2026-101132 - A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected elem

CVE-2026-101131 - A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unkn

CVE-2026-101111 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - Th

CVE-2026-101110 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - sit

CVE-2026-101109 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 -

CVE-2026-101108 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 -

CVE-2026-101105 - A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the

CVE-2026-100753 - Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7

CVE-2026-100752 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.

CVE-2026-96740 - A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties

CVE-2026-75600 - FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to

CVE-2026-55160 - Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-S

CVE-2026-55157 - Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live

CVE-2026-55156 - Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live

CVE-2026-54710 - FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execu

CVE-2026-54708 - FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exi

CVE-2026-54675 - FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exi

CVE-2026-54674 - FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User

CVE-2026-49994 - Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Blue

CVE-2026-45562 - FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (Mo

CVE-2026-101913 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to

CVE-2026-101912 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to

CVE-2026-101911 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to

CVE-2026-101910 - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.

CVE-2026-101909 - Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.

CVE-2026-101908 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch

CVE-2026-101907 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetc

CVE-2026-101906 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios sh

CVE-2026-101905 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node

CVE-2026-101904 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispa

CVE-2026-101903 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC

CVE-2026-101902 - Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.

CVE-2026-101901 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Ses

CVE-2026-101900 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveC

CVE-2026-101898 - Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HT

CVE-2026-101102 - A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function

CVE-2026-101101 - A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the func

CVE-2026-101100 - A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the funct

CVE-2026-101099 - A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part

CVE-2026-88816 - DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.

CVE-2026-88815 - DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv

CVE-2026-87969 - An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated ad

CVE-2026-87114 - A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrec

CVE-2026-86102 - An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker w

CVE-2026-85644 - XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The

CVE-2026-58464 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-58463 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-55096 - fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_

CVE-2026-54160 - Network UPS Tools is a collection of programs which provide a common interface for monitoring and ad

CVE-2026-48100 - Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior

CVE-2026-101894 - The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decomp

CVE-2026-101891 - An improper access control vulnerability in an internal API service on WatchGuard Access Points allo

CVE-2026-101098 - A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by thi

CVE-2026-101083 - A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown functi

CVE-2026-101082 - A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing o

CVE-2026-101081 - A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function

CVE-2026-97399 - The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture m

CVE-2026-93348 - Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19

CVE-2026-91154 - Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Acti

CVE-2026-88808 - A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to

CVE-2026-88805 - Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials

CVE-2026-88804 - An unauthenticated update of public UI settings could be used by remote attackers to execute a store

CVE-2026-12342 - This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code

CVE-2026-101861 - Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in sch

CVE-2026-101080 - A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the functio

CVE-2026-101079 - A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerabili

CVE-2026-101078 - A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unkn

CVE-2026-101077 - A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the

CVE-2026-101076 - A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the f

CVE-2026-96538 - WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-8

CVE-2026-93540 - A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations thr

CVE-2026-93539 - A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a

CVE-2026-93538 - A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated clus

CVE-2026-80359 - Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug

CVE-2026-80358 - Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug

CVE-2026-80357 - Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug

CVE-2026-70413 - Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password v

CVE-2026-4556 - Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privile

CVE-2026-101333 - A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrate

CVE-2026-101075 - A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the

CVE-2026-101074 - A weakness has been identified in Netcore NR289-GE 1.4.5102. The affected element is the function pa

CVE-2026-101073 - A security flaw has been discovered in Netcore NR289-GE 1.4.5102. Impacted is an unknown function of

CVE-2026-97335 - Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0

CVE-2026-93537 - A user who can supply bundle content to a repository referenced by a GitRepo resource, for example t

CVE-2026-90926 - Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom

CVE-2026-90925 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Inno

CVE-2026-90924 - Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Tra

CVE-2026-87799 - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixe

CVE-2026-87798 - Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD v

CVE-2026-86595 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-86335 - Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux all

CVE-2026-86334 - Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 bef

CVE-2026-85526 - Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authen

CVE-2026-85185 - Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.1

CVE-2026-73642 - Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenti

CVE-2026-73641 - Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare

CVE-2026-73640 - Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functiona

CVE-2026-15953 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB

CVE-2026-15952 - Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IE

CVE-2026-101072 - A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system

CVE-2026-101071 - A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability

CVE-2026-101070 - A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is

CVE-2026-86330 - An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_int

CVE-2026-82936 - mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consu

CVE-2026-82935 - mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v

CVE-2026-82933 - mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwo

CVE-2026-82932 - mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listenin

CVE-2026-82930 - mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all H

CVE-2026-82929 - mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-d

CVE-2026-82928 - mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, se

CVE-2026-82326 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-82323 - Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies In