CVE-2026-101066 - A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLin

CVE-2026-101055 - A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability

CVE-2026-94194 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in el

CVE-2026-92103 - Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a mali

CVE-2026-91043 - Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a mali

CVE-2026-87752 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-78424 - Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runt

CVE-2026-19444 - A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command

CVE-2026-12264 - Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA

CVE-2026-101054 - A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file o

CVE-2026-101053 - A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE

CVE-2026-101052 - A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some un

CVE-2026-91006 - Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to lau

CVE-2026-81867 - A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application

CVE-2026-81375 - A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration v

CVE-2026-19759 - An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integ

CVE-2026-12269 - Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vu

CVE-2026-12268 - ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windo

CVE-2026-12267 - ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Quer

CVE-2026-101040 - A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to

CVE-2026-101039 - A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the functi

CVE-2026-101038 - A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability i

CVE-2026-90979 - LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textual

CVE-2026-7172 - Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:

CVE-2026-7171 - Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:

CVE-2026-7170 - Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter:

CVE-2026-101037 - A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advert

CVE-2026-101036 - A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts t

CVE-2026-101035 - A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessa

CVE-2026-101018 - A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function grou

CVE-2026-95104 - Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated craf

CVE-2026-94287 - A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be u

CVE-2026-94286 - An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by mali

CVE-2026-94285 - An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used

CVE-2026-94284 - An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before

CVE-2026-94283 - An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 befo

CVE-2026-94282 - An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could

CVE-2026-86530 - BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings intern

CVE-2026-86507 - Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store

CVE-2026-85134 - Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc.

CVE-2026-82969 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-82915 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bims

CVE-2026-101017 - A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affect

CVE-2026-101016 - A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the fun

CVE-2026-101015 - A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is som

CVE-2026-101014 - A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulne

CVE-2026-91206 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-91204 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82546 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82387 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82386 - Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog adminis

CVE-2026-82385 - Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog ad

CVE-2026-82384 - Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker t

CVE-2026-82383 - Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote

CVE-2026-82382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82381 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Rolle

CVE-2026-82380 - Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-

CVE-2026-82379 - Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a val

CVE-2026-82378 - Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an un

CVE-2026-82377 - Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete

CVE-2026-82376 - Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entr

CVE-2026-82375 - Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-ed

CVE-2026-82348 - Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user

CVE-2026-101013 - A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec09

CVE-2026-101012 - A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6

CVE-2026-101011 - A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_dom

CVE-2026-101010 - A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function g

CVE-2026-93000 - The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a

CVE-2026-92996 - The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider tha

CVE-2026-89411 - The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe pay

CVE-2026-89303 - The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a paramete

CVE-2026-89300 - The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its

CVE-2026-88828 - The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user

CVE-2026-86838 - The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on

CVE-2026-84744 - The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from su

CVE-2026-101009 - A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function p

CVE-2026-101008 - A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file o

CVE-2026-101007 - A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputS

CVE-2026-101006 - A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expens

CVE-2026-101005 - A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalI

CVE-2026-100751 - Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Ac

CVE-2026-100750 - Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modul

CVE-2026-101004 - A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by t

CVE-2026-101003 - A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the

CVE-2026-101002 - A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function

CVE-2026-87723 - In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or wr

CVE-2026-101001 - A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval

CVE-2026-101000 - A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.

CVE-2026-100909 - A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the funct

CVE-2026-100908 - A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the compo

CVE-2026-100907 - A flaw has been found in Eyeplus 57.0.0.0308. The impacted element is an unknown function of the fil

CVE-2026-100906 - A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers o

CVE-2026-100904 - A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system u

CVE-2026-100903 - A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of

CVE-2026-100902 - A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this

CVE-2026-100901 - A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerabili

CVE-2026-100900 - A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta

CVE-2026-100899 - A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This i

CVE-2026-100898 - A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1.

CVE-2026-100897 - A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07eb

CVE-2026-100896 - A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the funct

CVE-2026-100895 - A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is

CVE-2026-100894 - A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6

CVE-2026-100893 - A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects t

CVE-2026-100892 - A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationT

CVE-2026-100891 - A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this iss

CVE-2026-100890 - A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerabilit

CVE-2026-100889 - A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the functi

CVE-2026-100888 - A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the fun

CVE-2026-100887 - A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81

CVE-2026-96284 - A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI r

CVE-2026-100886 - A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011.

CVE-2026-100885 - A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the

CVE-2026-100884 - A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the functi

CVE-2026-100883 - A flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function

CVE-2026-96283 - By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not a

CVE-2026-96282 - A malicious Flatpak extension can probe the host filesystem to determine what files and directories

CVE-2026-100882 - A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of t

CVE-2026-100881 - A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affect

CVE-2026-96281 - On a multi-user system, a user with an active local login session could downgrade a system-wide Flat

CVE-2026-96280 - The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functio

CVE-2026-101090 - Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the ne

CVE-2026-101089 - Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpo

CVE-2026-101088 - Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentin

CVE-2026-101087 - Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notif

CVE-2026-101086 - Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe

CVE-2026-101085 - Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non

CVE-2026-101084 - obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allo

CVE-2026-101065 - Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, th

CVE-2026-101064 - Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server regist

CVE-2026-101063 - Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/*

CVE-2026-101062 - Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=tr

CVE-2026-100880 - A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects un

CVE-2026-100879 - A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the functio

CVE-2026-100878 - A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the

CVE-2026-100877 - A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6

CVE-2026-96279 - A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user

CVE-2026-100876 - A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c349

CVE-2026-100875 - A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6

CVE-2026-100874 - A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3

CVE-2026-100873 - A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c

CVE-2026-101061 - utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabil

CVE-2026-101060 - python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommuni

CVE-2026-101059 - utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specification

CVE-2026-101058 - python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a ha

CVE-2026-101057 - utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server

CVE-2026-101056 - Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from

CVE-2026-101051 - Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowi

CVE-2026-101048 - Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/te

CVE-2026-101047 - Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages

CVE-2026-101046 - Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api

CVE-2026-101045 - Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metada

CVE-2026-101044 - pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.

CVE-2026-101043 - pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable pla

CVE-2026-88778 - Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetSca

CVE-2026-88777 - Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. T

CVE-2026-88776 - Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. Th

CVE-2026-88775 - Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affe

CVE-2026-88774 - Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before

CVE-2026-88773 - Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Ci

CVE-2026-88772 - Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before

CVE-2026-88771 - Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This

CVE-2026-101050 - Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook en

CVE-2026-101049 - Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs o

CVE-2026-101042 - Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 <

CVE-2026-101041 - The account recovery (password reset) functionality in the vulnerability-lookup web application cont

CVE-2026-101033 - KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expe

CVE-2026-101032 - navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into

CVE-2026-100872 - Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation,

CVE-2026-100871 - Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identif

CVE-2026-100870 - Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-res

CVE-2026-100869 - Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API end

CVE-2026-100868 - Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without

CVE-2026-100867 - spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version f

CVE-2026-100866 - onefetch through 2.28.1 writes repository information field values to the terminal without removing

CVE-2026-97165 - Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.

CVE-2026-97164 - Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Ev

CVE-2026-100749 - Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.

CVE-2026-100748 - Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

CVE-2026-100747 - Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to

CVE-2026-94417 - When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate

CVE-2026-93304 - A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange.

CVE-2026-93302 - MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affe

CVE-2026-89136 - When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could acc

CVE-2026-89135 - A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManage

CVE-2026-89134 - A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypa

CVE-2026-89133 - wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it

CVE-2026-89102 - In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, mult

CVE-2026-15442 - In all builds that make use of (D)TLS, including default builds, there is a series of conditional st

CVE-2026-94419 - Without NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSes

CVE-2026-94418 - Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separat

CVE-2026-100741 - Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versio

CVE-2026-97319 - The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and es

CVE-2026-97227 - The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capabili

CVE-2026-96899 - The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value sub

CVE-2026-96897 - The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one

CVE-2026-96896 - The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perfor

CVE-2026-96895 - The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed

CVE-2026-92995 - The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a

CVE-2026-92436 - The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify

CVE-2026-89006 - The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed conten

CVE-2026-89003 - The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check be

CVE-2026-89001 - The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a

CVE-2026-89000 - The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or

CVE-2026-86841 - The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent

CVE-2026-86839 - The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify t

CVE-2026-86609 - The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted throu

CVE-2026-85002 - The EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before out

CVE-2026-84069 - The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts a

CVE-2026-82841 - The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup

CVE-2026-81655 - The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its set

CVE-2026-100746 - A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redir

CVE-2026-100865 - Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient

CVE-2026-100864 - heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/fi

CVE-2026-100863 - Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both re

CVE-2026-100862 - heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in

CVE-2026-100861 - heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplie

CVE-2026-100860 - heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis w

CVE-2026-100859 - Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/te

CVE-2026-100858 - heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and

CVE-2026-100857 - AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString()

CVE-2026-100856 - AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field d

CVE-2026-100855 - AzuraCast before 0.23.6 contains a missing permission check vulnerability in the GET /api/station/{s

CVE-2026-100854 - AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint an

CVE-2026-100853 - In AzuraCast before 0.23.8, the public On-Demand download endpoint fails to verify playlist-level ac

CVE-2026-100852 - AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generati

CVE-2026-100851 - AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/

CVE-2026-100850 - AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in

CVE-2026-100849 - AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webho

CVE-2026-100848 - AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay"

CVE-2026-100847 - AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of Abs

CVE-2026-100846 - MONAI before 1.5.2 contains a deserialization of untrusted data vulnerability in the algo_from_pickl

CVE-2026-100845 - MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that un

CVE-2026-100844 - MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps

CVE-2026-100843 - MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle()

CVE-2026-100842 - MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in monai/b

CVE-2026-100841 - In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination track_m

CVE-2026-100840 - MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engin

CVE-2026-100839 - Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.18.0, the guest ke

CVE-2026-100838 - Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata age

CVE-2026-100837 - Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-re

CVE-2026-100836 - Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextCo

CVE-2026-100835 - Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE

CVE-2026-100834 - http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0,

CVE-2026-100833 - Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to

CVE-2026-100745 - A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function

CVE-2026-100744 - A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function

CVE-2026-100725 - http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a Basic

CVE-2026-100724 - http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring

CVE-2026-100723 - vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and