CVE-2026-64235 - In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relat

CVE-2026-64234 - In the Linux kernel, the following vulnerability has been resolved: tty: serial: pch_uart: add chec

CVE-2026-64233 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts->lo

CVE-2026-64232 - In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s

CVE-2026-64231 - In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registe

CVE-2026-64230 - In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irq_da

CVE-2026-64229 - In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB f

CVE-2026-64228 - In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL d

CVE-2026-64227 - In the Linux kernel, the following vulnerability has been resolved: ACPI: driver: Check ACPI_COMPAN

CVE-2026-64226 - In the Linux kernel, the following vulnerability has been resolved: sched_ext: Avoid UAF in scx_roo

CVE-2026-64225 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: CGX: add bounds c

CVE-2026-64224 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix double free i

CVE-2026-64223 - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only pr

CVE-2026-64222 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: avoid double free

CVE-2026-64221 - In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-fre

CVE-2026-64220 - In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->se

CVE-2026-64219 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate paylo

CVE-2026-64218 - In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: fix report_wor

CVE-2026-64217 - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in net

CVE-2026-64216 - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in net

CVE-2026-64215 - In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc ret

CVE-2026-64214 - In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant

CVE-2026-64213 - In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Add lock protecti

CVE-2026-64212 - In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't deref

CVE-2026-64211 - In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue han

CVE-2026-64210 - In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked wr

CVE-2026-64209 - In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of

CVE-2026-64208 - In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of

CVE-2026-17039 - A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform t

CVE-2026-8789 - The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to

CVE-2026-8308 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-7007 - The Zephyr ext2 file system validates the on-disk superblock in ext2_verify_disk_superblock() (subsy

CVE-2026-66007 - Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-b

CVE-2026-66006 - lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in t

CVE-2026-66005 - Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its lo

CVE-2026-66004 - BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_a

CVE-2026-58630 - Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges o

CVE-2026-58586 - Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does

CVE-2026-57106 - Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privil

CVE-2026-56163 - Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unautho

CVE-2026-55732 - Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C

CVE-2026-55731 - Unchecked input for loop condition (CWE-606) in the SNMP agent in Loytec LIP-ME201C, L-INX, L-GATE,

CVE-2026-55730 - Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms

CVE-2026-55729 - Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 bef

CVE-2026-55728 - Stack-based Buffer Overflow (CWE-121) in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec LIP-ME20

CVE-2026-49326 - Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan oper

CVE-2026-17059 - A flaw was found in the role-users endpoint of the keycloak-services library, which is the core comp

CVE-2026-16802 - Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Univer

CVE-2026-16801 - Improper control of generation of code ('Code Injection') in the variables feature in Devolutions Po

CVE-2026-16800 - Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions Pow

CVE-2026-16799 - Improper access control in the automation tests and workflows features in Devolutions PowerShell Uni

CVE-2026-16798 - Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShe

CVE-2026-12504 - Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-RO

CVE-2026-12503 - Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB,

CVE-2026-12502 - Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-

CVE-2026-12496 - Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX

CVE-2026-17048 - A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients

CVE-2026-9765 - Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue.

CVE-2026-7484 - External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS

CVE-2026-66144 - Although remote policy references are not retrieved during policy normalization, if they are manuall

CVE-2026-66143 - It is possible to bypass the maximum number of normalized policy alternatives that was introduced in

CVE-2026-66142 - Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or

CVE-2026-66010 - DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via

CVE-2026-66009 - Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL valid

CVE-2026-66008 - Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and

CVE-2026-46452 - Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result i

CVE-2026-45816 - NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This req

CVE-2026-45815 - Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R

CVE-2026-45813 - Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS serv

CVE-2026-45812 - Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertisi

CVE-2026-45811 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBL

CVE-2026-16743 - A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-suppli

CVE-2026-16730 - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE er

CVE-2026-15810 - A Cross-Site Scripting (XSS) vulnerability in Google Cloud Looker versions prior to 25.6.103, 25.12.

CVE-2026-15243 - Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client i

CVE-2026-10610 - Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged

CVE-2026-7483 - Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully con

CVE-2026-16634 - TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The

CVE-2026-15663 - The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to

CVE-2026-15401 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc

CVE-2026-10033 - The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions u

CVE-2026-63317 - Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP

CVE-2026-56392 - GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow duri

CVE-2026-56391 - GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte inp

CVE-2026-49745 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-49744 - Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmwa

CVE-2026-49743 - Software installed and run as a non-privileged user may conduct improper GPU system calls to manipul

CVE-2026-24727 - An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload functio

CVE-2026-15821 - The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cr

CVE-2026-15739 - The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripti

CVE-2026-15704 - In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln

CVE-2026-15346 - The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site

CVE-2026-12702 - In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an

CVE-2026-16910 - A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notif

CVE-2026-16519 - A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The

CVE-2026-15755 - The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site

CVE-2026-15665 - The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to

CVE-2026-15653 - The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerab

CVE-2026-15648 - The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wi

CVE-2026-15464 - The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_s

CVE-2026-15334 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

CVE-2026-15333 - The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates

CVE-2026-12654 - The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypas

CVE-2026-14603 - The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorizatio

CVE-2026-14172 - Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated

CVE-2026-12981 - The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation wh

CVE-2026-12877 - The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti

CVE-2026-12690 - The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license

CVE-2026-12689 - The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership che

CVE-2026-12688 - The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before gra

CVE-2026-12497 - The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C

CVE-2026-16870 - Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allo

CVE-2026-66141 - Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport i

CVE-2026-66140 - Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequ

CVE-2026-66139 - OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is

CVE-2026-66138 - In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach

CVE-2026-54422 - In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ir

CVE-2026-6454 - The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in vers

CVE-2026-15420 - The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vuln

CVE-2026-15100 - The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-13464 - The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t

CVE-2026-12736 - The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl

CVE-2026-11922 - A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-l

CVE-2026-11354 - The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in al

CVE-2025-9205 - The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to,

CVE-2026-62825 - Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges ove

CVE-2026-58275 - Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw

CVE-2026-56191 - Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp

CVE-2026-56167 - Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privi

CVE-2026-56165 - Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over

CVE-2026-56160 - Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate pri

CVE-2026-54120 - Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a

CVE-2026-50517 - Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over

CVE-2026-49159 - Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized a

CVE-2026-35425 - Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code

CVE-2026-50044 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability

CVE-2026-44955 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a

CVE-2026-42933 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit

CVE-2026-40430 - Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability

CVE-2026-28698 - Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a

CVE-2026-16767 - A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extr

CVE-2026-65694 - Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller

CVE-2026-65604 - Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open

CVE-2026-63732 - 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (

CVE-2026-63313 - 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fet

CVE-2026-16807 - Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to

CVE-2026-16806 - Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execu

CVE-2026-16805 - Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execut

CVE-2026-16804 - Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had c

CVE-2026-16765 - A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk

CVE-2026-16764 - A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSeria

CVE-2026-16763 - A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element

CVE-2025-71389 - Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because

CVE-2024-58355 - Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability

CVE-2024-58354 - cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerabilit

CVE-2024-58353 - Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS

CVE-2026-6924 - A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such,

CVE-2026-52439 - An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.ne

CVE-2026-50103 - A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adja

CVE-2026-50039 - The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to

CVE-2026-50032 - A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network a

CVE-2026-49035 - The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate reques

CVE-2026-47724 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v

CVE-2026-47723 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v

CVE-2026-39155 - Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the n

CVE-2026-38764 - An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv

CVE-2026-34496 - Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affect

CVE-2026-21655 - Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Contro

CVE-2026-21653 - Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server

CVE-2026-16796 - Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent

CVE-2026-16002 - The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash th

CVE-2026-15981 - The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in a

CVE-2026-15968 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-15967 - Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEi

CVE-2026-15966 - Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Tran

CVE-2026-15630 - A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod

CVE-2026-10697 - Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transf

CVE-2026-65706 - FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect vi

CVE-2026-65705 - FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill v

CVE-2026-65704 - FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause he

CVE-2026-65703 - FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video dec

CVE-2026-64785 - SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other

CVE-2026-63359 - The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an

CVE-2026-60122 - gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the

CVE-2026-48013 - Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/exte

CVE-2026-48012 - Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Sh

CVE-2026-47722 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v

CVE-2026-47670 - DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated

CVE-2026-47669 - DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` funct

CVE-2026-25800 - Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting

CVE-2026-15212 - The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up t

CVE-2026-12353 - An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for R

CVE-2026-65010 - Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extrac

CVE-2026-63765 - Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads control

CVE-2026-16756 - Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the de

CVE-2026-15687 - A security issue was discovered in the Kubernetes Java client library where a compromised pod may be

CVE-2026-6516 - Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code

CVE-2026-65920 - Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _g

CVE-2026-65919 - Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/syst

CVE-2026-65918 - PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul

CVE-2026-65763 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper valid

CVE-2026-65762 - Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper

CVE-2026-65702 - Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persi

CVE-2026-65701 - SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability

CVE-2026-65700 - h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that

CVE-2026-65699 - AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability th

CVE-2026-47769 - APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP

CVE-2026-47755 - ITFlow provides an IT documentation, ticketing and accounting system for small managed service provi

CVE-2026-47752 - Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2

CVE-2026-47743 - Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir

CVE-2026-47668 - DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner

CVE-2026-44210 - Kata Containers is an open source project focusing on a standard implementation of lightweight Virtu

CVE-2026-65761 - Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.

CVE-2026-65760 - Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy

CVE-2026-65759 - Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.

CVE-2026-65698 - Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that a

CVE-2026-65697 - Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics coll

CVE-2026-65696 - Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability

CVE-2026-65695 - Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools

CVE-2026-44909 - Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A re

CVE-2026-16768 - A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exc

CVE-2026-65917 - CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDO

CVE-2026-65916 - CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in

CVE-2026-48539 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights s

CVE-2026-48538 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import

CVE-2026-48537 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive A

CVE-2026-48536 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settin

CVE-2026-48535 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home prox

CVE-2026-48534 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server co

CVE-2026-48533 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-48532 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History R

CVE-2026-48531 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Poli

CVE-2026-48530 - GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification

CVE-2026-16584 - Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh

CVE-2026-15617 - Logto performs principal lookup without normalizing email and identifier strings, enabling principal

CVE-2026-15616 - Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass se

CVE-2026-15615 - Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audien

CVE-2026-15614 - Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within

CVE-2026-15612 - Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling repl

CVE-2026-15611 - Logto allows unverified email-based SSO account linking, enabling an attacker to register an identit

CVE-2026-11804 - Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framewo

CVE-2026-43823 - When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-f

CVE-2026-43820 - NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS

CVE-2026-8287 - Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems

CVE-2026-65914 - DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into

CVE-2026-65913 - DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows

CVE-2026-65912 - DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a

CVE-2026-65911 - In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanit

CVE-2026-65904 - DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element ori

CVE-2026-65903 - DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluatio