CVE-2026-18462 - Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (C

CVE-2026-18461 - Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries

CVE-2026-18460 - Off-by-one Error, Out-of-bounds Write vulnerability in RTI Connext Professional (Core Libraries) all

CVE-2026-18459 - Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existi

CVE-2026-18458 - Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incom

CVE-2026-18457 - Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflo

CVE-2026-11389 - Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incom

CVE-2026-11388 - Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. Thi

CVE-2026-95818 - A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.

CVE-2026-94456 - Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically

CVE-2026-94455 - An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable withou

CVE-2026-87902 - An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen

CVE-2026-86062 - LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src

CVE-2026-86059 - Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organizatio

CVE-2026-85740 - LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_address

CVE-2026-85734 - LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login en

CVE-2026-85725 - LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in

CVE-2026-85709 - LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API s

CVE-2026-84301 - FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.

CVE-2026-83803 - Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry insta

CVE-2026-83603 - Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command

CVE-2026-83602 - Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/set

CVE-2026-83601 - Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send

CVE-2026-83600 - Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send

CVE-2026-83599 - Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket s

CVE-2026-83598 - Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Ag

CVE-2026-76819 - Rejected reason: Further research determined the issue results from a dependency.

CVE-2026-76805 - Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAS

CVE-2026-76804 - Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the wor

CVE-2026-76803 - Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuc

CVE-2026-76802 - Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAS

CVE-2026-56682 - 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to re

CVE-2026-13087 - Rejected reason: This CVE was reserved in error and duplicates CVE-2026-89530.

CVE-2026-95806 - MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console ent

CVE-2026-95805 - A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEven

CVE-2026-95655 - Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowi

CVE-2026-95654 - Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching

CVE-2026-95653 - Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creatio

CVE-2026-94640 - A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a

CVE-2026-92706 - Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126

CVE-2026-90462 - A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` incl

CVE-2026-88010 - Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassw

CVE-2026-86805 - A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Li

CVE-2026-86698 - Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user w

CVE-2026-85055 - Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-lev

CVE-2026-81886 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81885 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81884 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81883 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81882 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81881 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81880 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81879 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-81878 - radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radar

CVE-2026-80156 - Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80155 - Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80154 - All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02

CVE-2026-80152 - Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80151 - Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80150 - Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80149 - Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80148 - Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before

CVE-2026-80147 - Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and al

CVE-2026-80146 - Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and al

CVE-2026-80145 - Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and al

CVE-2026-80144 - Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and al

CVE-2026-80143 - Lantronix SLC8000/SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and al

CVE-2026-79913 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, the ValidateExternal

CVE-2026-79312 - webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id

CVE-2026-79311 - webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().

CVE-2026-77637 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and

CVE-2026-77633 - Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg

CVE-2026-77621 - Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink re

CVE-2026-77620 - Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash sou

CVE-2026-77619 - Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash sou

CVE-2026-75608 - Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/

CVE-2026-75607 - Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/

CVE-2026-75517 - Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu inte

CVE-2026-75511 - Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu acce

CVE-2026-75510 - Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @n

CVE-2026-70410 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in

CVE-2026-63374 - AnyIO is a high level asynchronous concurrency and networking framework that works on top of either

CVE-2026-56681 - 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to re

CVE-2026-95754 - In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (t

CVE-2026-95703 - In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value

CVE-2026-95701 - In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a

CVE-2026-95698 - The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-

CVE-2026-95697 - MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force p

CVE-2026-95693 - In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invo

CVE-2026-95685 - MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInRepor

CVE-2026-95683 - In MISP, the Overmind event view enriches an event with its most recent attached report for preview

CVE-2026-95501 - A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affe

CVE-2026-95500 - A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted

CVE-2026-94570 - SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control m

CVE-2026-94127 - When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific ma

CVE-2026-93344 - MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the

CVE-2026-93088 - SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution bec

CVE-2026-89407 - NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" wit

CVE-2026-84388 - A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Ext

CVE-2026-79315 - A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflec

CVE-2026-79314 - A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modi

CVE-2026-79313 - webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session manage

CVE-2026-65179 - NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untruste

CVE-2026-65178 - NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted mod

CVE-2026-65130 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS

CVE-2026-65129 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause im

CVE-2026-65128 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQ

CVE-2026-65127 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause ex

CVE-2026-65126 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause im

CVE-2026-65125 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause ex

CVE-2026-65124 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an

CVE-2026-65121 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause a

CVE-2026-65118 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause im

CVE-2026-65117 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause us

CVE-2026-65115 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause unco

CVE-2026-65114 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause mi

CVE-2026-65113 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause us

CVE-2026-65112 - NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause un

CVE-2026-65111 - NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an at

CVE-2026-24267 - NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component,

CVE-2026-24239 - NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an att

CVE-2026-19915 - A potential security vulnerability has been identified in the HP Support Assistant for versions prio

CVE-2026-95682 - MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition scree

CVE-2026-95679 - MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The u

CVE-2026-95675 - D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution

CVE-2026-95674 - In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and ite

CVE-2026-95671 - In MISP, the CollectionsController add() method enforced the sharing-group usability authorization c

CVE-2026-95667 - The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file

CVE-2026-95666 - Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail t

CVE-2026-95665 - MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export c

CVE-2026-95499 - A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects

CVE-2026-95396 - A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8

CVE-2026-93343 - MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the

CVE-2026-93342 - MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the

CVE-2026-93341 - MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the

CVE-2026-12718 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-95661 - MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view.

CVE-2026-95659 - MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::vie

CVE-2026-95658 - MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's u

CVE-2026-95619 - A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the ali

CVE-2026-95273 - A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the functio

CVE-2026-95272 - A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function sta

CVE-2026-95271 - A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is

CVE-2026-93616 - A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and

CVE-2026-75791 - Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authenticat

CVE-2026-95270 - A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the funct

CVE-2026-89420 - Improper Validation of Specified Quantity in Input in ZenHive mpp allows a client holding an open pa

CVE-2026-87119 - Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscri

CVE-2026-74849 - Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code

CVE-2026-63279 - LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existe

CVE-2026-63278 - URLs could be constructed which expanded environment variable or INI file values, so potentially sen

CVE-2026-63276 - LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is ex

CVE-2026-63275 - LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed

CVE-2026-63274 - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream ob

CVE-2026-63273 - LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypte

CVE-2026-63272 - LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow exis

CVE-2026-95623 - The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist

CVE-2026-92882 - Insufficiently protected credentials in the host and folder configuration endpoints of the REST API

CVE-2026-90990 - Improper neutralization of newlines in filter values in the monitoring host and service list APIs in

CVE-2026-94117 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-90882 - The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin to

CVE-2026-25265 - Privilege escalation due to weak configuration while temporary file handling.

CVE-2026-25264 - Privilege escalation due to weak configuration during package extraction process.

CVE-2026-25262 - Memory corruption while processing a crafted ELF file in the Primary Bootloader.

CVE-2026-25255 - Exposed dangerous function lead to privilege escalation via gRPC server.

CVE-2026-25254 - Improper authorization leads to Remote Code Execution via SocketIO interface.

CVE-2026-9231 - The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerab

CVE-2026-95511 - Rejected reason: Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requir

CVE-2026-95508 - A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When th

CVE-2026-93928 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booki

CVE-2026-93556 - The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the a

CVE-2026-89422 - Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answer

CVE-2026-68956 - Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authe

CVE-2026-65634 - Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote

CVE-2026-15095 - The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin

CVE-2026-9004 - The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Info

CVE-2026-95503 - A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access

CVE-2026-93952 - VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attack

CVE-2026-93836 - The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scri

CVE-2026-93778 - The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp

CVE-2026-92969 - The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local

CVE-2026-92235 - The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in al

CVE-2026-91092 - The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, a

CVE-2026-87082 - Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidate

CVE-2026-87081 - Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding

CVE-2026-87080 - Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing

CVE-2026-87079 - Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost

CVE-2026-87078 - Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejecte

CVE-2026-7622 - The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and inclu

CVE-2026-74766 - Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decod

CVE-2026-74765 - Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow o

CVE-2026-6922 - The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Aut

CVE-2026-4123 - The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all

CVE-2026-1645 - The Hostel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_currenc

CVE-2026-18439 - The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure

CVE-2026-18345 - The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a

CVE-2026-16778 - The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cros

CVE-2026-12995 - The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in

CVE-2025-1281 - The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insuffic

CVE-2025-1280 - The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up

CVE-2025-14487 - The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to

CVE-2025-14486 - The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing aut

CVE-2025-14484 - The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missin

CVE-2016-15059 - Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes

CVE-2026-94504 - Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encod

CVE-2026-92438 - The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputtin

CVE-2026-91827 - The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being

CVE-2026-89412 - The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner

CVE-2026-93655 - The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'w

CVE-2026-88788 - The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling va

CVE-2026-85653 - The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '

CVE-2026-12470 - The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unau

CVE-2026-19658 - The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,

CVE-2026-13355 - The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in vers

CVE-2026-94493 - A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unkno

CVE-2026-94492 - A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown

CVE-2026-94491 - A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcas

CVE-2026-93712 - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative p

CVE-2026-93711 - Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_

CVE-2026-93710 - Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when th

CVE-2026-93709 - Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its p

CVE-2026-76974 - SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated

CVE-2026-94490 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candi

CVE-2026-94489 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candi

CVE-2026-94426 - A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown fu

CVE-2026-94425 - A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is t

CVE-2026-94627 - vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV cache block ownership when co

CVE-2026-94626 - vLLM through 0.29.0 fails to validate the tp_size parameter in kv_transfer_params on OpenAI-compatib

CVE-2026-94625 - vLLM through 0.29.0 contains a resource exhaustion vulnerability in MooncakeConnector where rejected

CVE-2026-94624 - vLLM through 0.29.0 contains a denial of service vulnerability in P2P KV offloading when OffloadingC

CVE-2026-94623 - vLLM through 0.29.0 contains a denial of service vulnerability in the NIXL connector's prefix cachin

CVE-2026-94622 - vLLM versions through 0.29.0 contain a denial of service vulnerability in the NIXL connector's metad

CVE-2026-94540 - DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attacker

CVE-2026-94536 - lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource

CVE-2026-94535 - lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpo

CVE-2026-94534 - lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/av

CVE-2026-94533 - lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController tha

CVE-2026-94532 - lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endp

CVE-2026-93340 - Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows una

CVE-2026-88756 - Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the creden

CVE-2026-88738 - Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgra

CVE-2026-79079 - An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/

CVE-2026-78847 - An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines

CVE-2026-78806 - An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allow

CVE-2026-65980 - Chartbrew is an open-source web application that can connect directly to databases and APIs and use

CVE-2026-61852 - Chartbrew is an open-source web application that can connect directly to databases and APIs and use

CVE-2026-61851 - Chartbrew is an open-source web application that can connect directly to databases and APIs and use

CVE-2026-61743 - Chartbrew is an open-source web application that can connect directly to databases and APIs and use

CVE-2026-61652 - Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory

CVE-2026-61541 - Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an app