CVE-2026-88408 - FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGro

CVE-2026-88407 - An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis modu

CVE-2026-88406 - FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _Valida

CVE-2026-88405 - A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/r

CVE-2026-88404 - A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/se

CVE-2026-88403 - A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authen

CVE-2026-88402 - A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to acces

CVE-2026-79919 - MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library c

CVE-2026-79918 - MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor L

CVE-2026-79917 - MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{ap

CVE-2026-79916 - MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace me

CVE-2026-79317 - A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side si

CVE-2026-79316 - An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modi

CVE-2026-77525 - MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-reco

CVE-2026-77523 - MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model pa

CVE-2026-77522 - MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledg

CVE-2026-77521 - MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a

CVE-2026-77520 - MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the

CVE-2026-77519 - MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp au

CVE-2026-77518 - MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace u

CVE-2026-77517 - MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document

CVE-2026-77516 - MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role

CVE-2026-73553 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73551 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73511 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-67827 - Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers

CVE-2026-61647 - NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exportin

CVE-2026-59816 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-58272 - Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Ver

CVE-2026-58270 - Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Pri

CVE-2026-55179 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-55105 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-49453 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-49450 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-49449 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-46649 - Joplin is an open source note-taking and to-do application that organises notes and lists into noteb

CVE-2026-85219 - Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated rem

CVE-2026-81469 - Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Elemen

CVE-2026-79320 - Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component r

CVE-2026-79319 - Stencil core 4.43.5 is vulnerable to Incorrect Access Control.

CVE-2026-79318 - web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Tra

CVE-2026-73552 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73550 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73549 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73548 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73547 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73546 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73513 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-73512 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-62247 - Supabase Realtime provides Broadcast, Presence, and Postgres Changes via WebSockets. Prior to 2.111.

CVE-2026-58271 - Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Pri

CVE-2026-58269 - Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Pri

CVE-2026-55897 - luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to r

CVE-2026-55159 - luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with

CVE-2026-54915 - Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the

CVE-2026-52835 - Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the

CVE-2026-50572 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-49995 - Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the

CVE-2026-49811 - Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment

CVE-2026-48521 - Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36

CVE-2026-45381 - Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the

CVE-2026-94501 - jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints

CVE-2026-94497 - jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints ac

CVE-2026-94496 - jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authe

CVE-2026-94495 - jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemCon

CVE-2026-94494 - jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users

CVE-2026-94414 - jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint

CVE-2026-94413 - jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticate

CVE-2026-94412 - jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoin

CVE-2026-94411 - jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoin

CVE-2026-94403 - A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001

CVE-2026-91167 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpg

CVE-2026-91166 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, th

CVE-2026-91165 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the respons

CVE-2026-91164 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HT

CVE-2026-82165 - Dell Command | Integration Suite for System Center, versions prior to 6.7.2, contain an Incorrect De

CVE-2026-82163 - Dell Command | Intel vPro Out of Band, versions prior to 4.7.2, contain an Incorrect Default Permiss

CVE-2026-66280 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-63330 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_rec

CVE-2026-63329 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server

CVE-2026-61749 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who

CVE-2026-61748 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/re

CVE-2026-61747 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and

CVE-2026-61746 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAl

CVE-2026-61744 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts

CVE-2026-58491 - Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpg

CVE-2026-49810 - Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive

CVE-2026-17052 - The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_

CVE-2026-94488 - Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.

CVE-2026-93012 - Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution

CVE-2026-92382 - An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfe

CVE-2026-69190 - Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the v

CVE-2026-62369 - KubeEdge is an open source system for extending native containerized application orchestration capab

CVE-2026-62182 - KubeEdge is an open source system for extending native containerized application orchestration capab

CVE-2026-61745 - InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/

CVE-2026-61612 - CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF gu

CVE-2026-55473 - HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets

CVE-2026-48976 - HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in b

CVE-2026-48975 - HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Upd

CVE-2026-48974 - HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invoke

CVE-2026-48826 - HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend

CVE-2026-94449 - A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strate

CVE-2026-84990 - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/

CVE-2026-83621 - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2

CVE-2026-79920 - Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user

CVE-2026-77582 - Tinyauth is an authentication and authorization server. Prior to 5.1.0, Tinyauth exposes a remotely

CVE-2026-77561 - Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote at

CVE-2026-77560 - Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded

CVE-2026-76898 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/ma

CVE-2026-63416 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/ma

CVE-2026-63373 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OA

CVE-2026-63334 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deploy

CVE-2026-63116 - deepstream is a server that allows clients and backend services to sync data, send messages and make

CVE-2026-62987 - Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.

CVE-2026-62866 - Dasel is a command-line tool and library for querying, modifying, and transforming data structures.

CVE-2026-62371 - KubeEdge is an open source system for extending native containerized application orchestration capab

CVE-2026-62370 - KubeEdge is an open source system for extending native containerized application orchestration capab

CVE-2026-61674 - Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and

CVE-2026-59168 - Dasel is a command-line tool and library for querying, modifying, and transforming data structures.

CVE-2026-58504 - draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, openin

CVE-2026-17051 - The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound mes

CVE-2026-17050 - The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_de

CVE-2026-88978 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-85751 - Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and pr

CVE-2026-84298 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-82412 - ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability

CVE-2026-77166 - The emoji field in the page emoji update endpoint does not properly validate user input. By injectin

CVE-2026-77165 - File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently

CVE-2026-63342 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-61687 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-61681 - Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale.

CVE-2026-55563 - Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflo

CVE-2026-53940 - Conda is a system-level binary package and environment manager that runs on major operating systems

CVE-2026-36472 - CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __refer

CVE-2026-36471 - Deserialization of Untrusted Data of the __post_data parameter in cn_parse_url() in CuteNews v.2.1.2

CVE-2026-36470 - CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer

CVE-2026-36469 - CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- up

CVE-2026-36468 - Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers

CVE-2026-36467 - Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows

CVE-2026-94301 - The fix for CVE-2026-47065/ZDRES-232 ("resolveProxyClass Not Overridden - acceptMatchers Filter Bypa

CVE-2026-94184 - A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious

CVE-2026-93339 - Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vu

CVE-2026-86473 - Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token co

CVE-2026-82355 - When a request to the Airflow core API carries both a session cookie and an explicit `Authorization:

CVE-2026-80110 - A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding

CVE-2026-75939 - A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) rel

CVE-2026-75158 - Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no

CVE-2026-71543 - OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, templated ACL, P

CVE-2026-68919 - GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and es

CVE-2026-61630 - nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any

CVE-2026-61629 - nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the

CVE-2026-61628 - nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/use

CVE-2026-55870 - GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that admi

CVE-2026-55625 - GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test

CVE-2026-55567 - BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Window

CVE-2026-55074 - Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec.

CVE-2026-55071 - MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Pri

CVE-2026-55060 - GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endp

CVE-2026-54584 - mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package me

CVE-2026-52743 - GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does

CVE-2026-52742 - GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful

CVE-2026-52741 - GoCD is a continuous deliver server. From 18.3.0 until 26.1.0, GoCD can generate unescaped tracking-

CVE-2026-52740 - GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares

CVE-2026-94404 - MISP has a security issue that could let an attacker change threat-intelligence data through a logge

CVE-2026-94401 - MISP has a file-handling vulnerability that could let certain authenticated users make the server re

CVE-2026-94394 - When a regular user adds a reference between objects or attributes, MISP checks whether the user can

CVE-2026-94393 - When a user creates or edits a report inside an event, MISP can identify an existing report using it

CVE-2026-94387 - Aureus ERP before 1.6.0 contains a stored cross-site scripting vulnerability in the Chatter field-ch

CVE-2026-94382 - Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELE

CVE-2026-93884 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in

CVE-2026-88807 - A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X s

CVE-2026-88806 - A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbG

CVE-2026-85220 - A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attack

CVE-2025-71421 - UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the ed

CVE-2025-71420 - UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply

CVE-2025-71419 - UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the Swift

CVE-2026-94383 - The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without val

CVE-2026-94381 - MISP has a security issue that can let a user gain more access than their API key is supposed to all

CVE-2026-94379 - The login() function in MISP's UsersController.php contained insufficient HTTP method validation for

CVE-2026-94374 - MISP contains an insecure direct object reference vulnerability in the processModuleResultsData meth

CVE-2026-94373 - MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript

CVE-2026-94372 - MISP contains a stored cross-site scripting (XSS) vulnerability in the default theme's Galaxies inde

CVE-2026-94216 - A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects

CVE-2026-94214 - A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of

CVE-2026-94211 - A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown

CVE-2026-84285 - An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 cou

CVE-2026-94368 - A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBa

CVE-2026-94210 - A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function

CVE-2026-91867 - When Neethi fetches a remote policy reference, it only limits the time per read, not the whole trans

CVE-2026-91866 - A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponen

CVE-2026-91865 - A small WS-Policy document using repeated policy references can force Neethi to re-expand the same r

CVE-2026-91864 - A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which N

CVE-2026-91863 - A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nestin

CVE-2026-89139 - Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that modul

CVE-2026-87858 - Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supp

CVE-2026-65654 - github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes

CVE-2026-65653 - github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadat

CVE-2026-65652 - github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChan

CVE-2026-65651 - temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a corresp

CVE-2026-16652 - Temporal Server did not bound the work performed while searching for a Schedule's next action time.

CVE-2026-16651 - temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version co

CVE-2026-92612 - In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable b

CVE-2026-77021 - Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2

CVE-2026-94277 - MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy

CVE-2026-92574 - A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious chec

CVE-2026-91921 - Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side ren

CVE-2026-94152 - A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This im

CVE-2026-94151 - A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown func

CVE-2026-94150 - A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is

CVE-2026-92400 - The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an

CVE-2026-86802 - The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an

CVE-2026-85113 - The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied v

CVE-2026-85010 - The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price

CVE-2026-15801 - A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI

CVE-2025-12999 - UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URL

CVE-2026-94149 - A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an u

CVE-2026-94148 - A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExport

CVE-2026-47321 - The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate

CVE-2026-94218 - A flaw was found in the authentication session management of Keycloak, an identity and access manage

CVE-2026-94217 - A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in th

CVE-2026-94215 - A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management so

CVE-2026-94213 - A flaw was found in the Authorization Services component of Keycloak, an open-source identity and ac

CVE-2026-94146 - A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function su

CVE-2026-94145 - A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unkn

CVE-2026-94144 - A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria

CVE-2026-90860 - The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an extern

CVE-2026-82187 - The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extens

CVE-2026-94143 - A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the f

CVE-2026-94142 - A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Aff

CVE-2026-94139 - A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r1

CVE-2026-90839 - Rejected reason: this is rejected

CVE-2026-94138 - A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-2103

CVE-2026-94137 - A vulnerability was identified in Hangzhou Shunwang Technology shzh 10.7.2.693. This affects the fun

CVE-2026-94185 - nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before

CVE-2026-94129 - A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects t

CVE-2026-94128 - A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the f

CVE-2026-94110 - A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self

CVE-2026-94103 - A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of

CVE-2026-94102 - A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.p

CVE-2026-94101 - A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected eleme

CVE-2026-94100 - A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wan_c

CVE-2026-94099 - A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some u

CVE-2026-94098 - A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unk

CVE-2026-94097 - A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part o

CVE-2026-94096 - A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unkn

CVE-2026-94095 - A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability

CVE-2026-94094 - A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler o

CVE-2026-94093 - A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the

CVE-2026-94092 - A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torc

CVE-2026-94091 - A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function