CVE-2026-93576 - A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return

CVE-2026-93573 - A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass

CVE-2026-93569 - A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's

CVE-2026-93568 - A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially c

CVE-2026-93567 - A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the com

CVE-2026-93566 - A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP

CVE-2026-93565 - A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trail

CVE-2026-93564 - A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a r

CVE-2026-93558 - A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can

CVE-2026-93506 - A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the

CVE-2026-93505 - A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file sr

CVE-2026-85511 - A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron

CVE-2026-77929 - ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users

CVE-2026-77928 - ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticat

CVE-2026-77927 - ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticat

CVE-2026-25684 - A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allo

CVE-2026-16515 - net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section

CVE-2026-16514 - gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a re

CVE-2026-16512 - gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPT

CVE-2026-10832 - A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit

CVE-2025-1350 - IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacke

CVE-2025-13882 - IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 thro

CVE-2024-56344 - IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote a

CVE-2026-93606 - vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedde

CVE-2026-93605 - vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTIN

CVE-2026-93604 - vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embed

CVE-2026-93603 - vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the appl

CVE-2026-93602 - rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching log

CVE-2026-93601 - rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.

CVE-2026-93600 - rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.

CVE-2026-93599 - rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reacha

CVE-2026-93598 - ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-li

CVE-2026-93597 - ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by

CVE-2026-93596 - ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated prin

CVE-2026-93595 - ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool ex

CVE-2026-93594 - ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-reco

CVE-2026-93593 - ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types becaus

CVE-2026-93592 - vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and

CVE-2026-93591 - SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt funct

CVE-2026-93590 - ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to

CVE-2026-93589 - ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An i

CVE-2026-93588 - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM code

CVE-2026-93587 - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD (and, per the u

CVE-2026-93586 - ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the Imag

CVE-2026-93560 - A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP fr

CVE-2026-93504 - A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/rout

CVE-2026-93019 - Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 327

CVE-2026-93018 - Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image wi

CVE-2026-88623 - NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter

CVE-2026-88622 - NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

CVE-2026-79294 - Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote atta

CVE-2026-62282 - OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for W

CVE-2023-5778 - Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, A

CVE-2026-93492 - A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/

CVE-2026-93491 - A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vul

CVE-2026-93488 - A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initi

CVE-2026-28199 - An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary fi

CVE-2026-28198 - An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could b

CVE-2026-28197 - An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could s

CVE-2026-21806 - HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. Th

CVE-2026-93578 - A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to ve

CVE-2026-93575 - A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnera

CVE-2026-93572 - A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vul

CVE-2026-93563 - A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a maliciou

CVE-2026-93561 - A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly re

CVE-2026-81627 - A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the wr

CVE-2026-92976 - A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Syste

CVE-2026-90884 - The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes

CVE-2026-87915 - The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder p

CVE-2026-87743 - A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in

CVE-2026-18405 - The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin

CVE-2026-15797 - The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder p

CVE-2026-15579 - An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper val

CVE-2026-85410 - The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widge

CVE-2026-83561 - The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Sit

CVE-2026-6205 - An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager

CVE-2026-56597 - HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which co

CVE-2026-56595 - HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly

CVE-2026-56592 - HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability rel

CVE-2026-56590 - HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improp

CVE-2026-4036 - An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerabilit

CVE-2026-40539 - An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM)

CVE-2026-40538 - An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology

CVE-2026-40537 - A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager

CVE-2026-40536 - An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in A

CVE-2026-40535 - An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in D

CVE-2026-40534 - An improper neutralization of input during web page generation ('cross-site scripting') vulnerabilit

CVE-2026-40533 - An exposure of sensitive information through data queries vulnerability in Desktop API in Synology D

CVE-2026-40532 - A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager

CVE-2026-40531 - An integer overflow or wraparound vulnerability in File Operation in Synology DiskStation Manager (D

CVE-2026-40530 - An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synolog

CVE-2026-21848 - HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could

CVE-2026-21822 - HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService compo

CVE-2026-13684 - An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DS

CVE-2026-13683 - An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit

CVE-2026-13673 - An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskS

CVE-2026-13666 - An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Syno

CVE-2026-13639 - An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.

CVE-2026-13635 - An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager

CVE-2026-13623 - An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerabilit

CVE-2025-13533 - The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in al

CVE-2026-93494 - A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulne

CVE-2026-93493 - A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this v

CVE-2026-92622 - The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'light

CVE-2026-92554 - The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vu

CVE-2026-92249 - The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via

CVE-2026-90981 - The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected

CVE-2026-89059 - A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodie

CVE-2026-89058 - A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflec

CVE-2026-85705 - The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and

CVE-2026-85652 - The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to tim

CVE-2026-75961 - The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQ

CVE-2026-75157 - Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with

CVE-2026-67103 - HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could a

CVE-2026-67102 - HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, wh

CVE-2026-67101 - HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in i

CVE-2026-67100 - HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure fla

CVE-2026-18442 - The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to

CVE-2026-17607 - The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortco

CVE-2026-17586 - The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

CVE-2026-16777 - The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPr

CVE-2026-15275 - The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the '

CVE-2026-15004 - The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to

CVE-2026-14472 - The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubi

CVE-2026-14323 - The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Di

CVE-2026-13471 - The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab

CVE-2026-12954 - The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions

CVE-2026-12739 - The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to

CVE-2026-12384 - Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allo

CVE-2026-11757 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-92714 - The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versi

CVE-2026-92619 - The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up t

CVE-2026-92561 - The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'o

CVE-2026-91707 - The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up t

CVE-2026-90977 - The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the store

CVE-2026-90976 - The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled bef

CVE-2026-89413 - The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to,

CVE-2026-89330 - The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF d

CVE-2026-89278 - The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugi

CVE-2026-89138 - The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to,

CVE-2026-88994 - The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before

CVE-2026-86800 - The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-c

CVE-2026-86796 - The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooC

CVE-2026-84909 - The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to St

CVE-2026-79713 - The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query par

CVE-2026-75017 - The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts B

CVE-2026-75016 - The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News T

CVE-2026-18317 - The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPres

CVE-2026-17576 - The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments actio

CVE-2026-12106 - The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in

CVE-2024-38639 - An improper authentication vulnerability has been reported to affect product. The remote attackers c

CVE-2024-27123 - A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attacker

CVE-2026-93485 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-90984 - The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destinatio

CVE-2026-90978 - The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX ha

CVE-2026-89008 - The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an auth

CVE-2026-89007 - The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capab

CVE-2026-88993 - The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute

CVE-2026-88844 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the reques

CVE-2026-88825 - The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearan

CVE-2026-88798 - The Really Simple Security WordPress plugin before 9.8.3 does not validate a client-supplied addres

CVE-2026-87966 - The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization

CVE-2026-87965 - The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize

CVE-2026-87775 - The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter

CVE-2026-87774 - The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter

CVE-2026-87771 - The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape paramete

CVE-2026-87770 - The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape para

CVE-2026-87767 - The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and es

CVE-2026-85350 - The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through

CVE-2026-85127 - The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type

CVE-2026-85123 - The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted va

CVE-2026-85122 - The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted va

CVE-2026-85009 - The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery fl

CVE-2026-84904 - The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authoriza

CVE-2026-84903 - The King Addons for Elementor WordPress plugin before 51.1.81 does not perform any capability, post

CVE-2026-84902 - The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level auth

CVE-2026-84738 - The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through

CVE-2026-81810 - The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability

CVE-2026-81340 - The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object own

CVE-2026-18912 - ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection

CVE-2026-18911 - ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass

CVE-2026-17086 - The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulner

CVE-2026-93468 - The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote att

CVE-2026-93467 - The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote

CVE-2026-93371 - A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue aff

CVE-2026-92991 - The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sig

CVE-2026-15650 - The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to

CVE-2026-14855 - The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left

CVE-2026-93456 - django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin

CVE-2026-93455 - django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, al

CVE-2026-93331 - A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_par

CVE-2026-93314 - A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueTyp

CVE-2026-93313 - A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2

CVE-2026-82985 - The Photos app's filter-based "smart albums" build their file listing using the search configuration

CVE-2026-82982 - The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshnes

CVE-2026-82980 - Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths o

CVE-2026-77170 - The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary

CVE-2026-77169 - A vulnerability in the team folders (formerly group folders) app when used in combination with the w

CVE-2026-77164 - Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust

CVE-2026-68493 - After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a

CVE-2026-93312 - A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind o

CVE-2026-93311 - A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function Sampled

CVE-2026-93310 - A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the c

CVE-2026-79954 - NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) rece

CVE-2026-93454 - Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML i

CVE-2026-93453 - SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the a

CVE-2026-93452 - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer,

CVE-2026-93451 - snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Arr

CVE-2026-93450 - go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON pars

CVE-2026-93309 - A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknow

CVE-2026-93308 - A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unkno

CVE-2026-85887 - Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker

CVE-2026-85878 - Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate pri

CVE-2026-83946 - Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal

CVE-2026-69843 - Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate pri

CVE-2026-62874 - Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to e

CVE-2026-2585 - The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘

CVE-2026-18441 - The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres

CVE-2026-93436 - vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests

CVE-2026-93435 - redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser th

CVE-2026-87886 - Local privilege escalation due to insecure file permissions. The following products are affected: Ac

CVE-2026-87701 - Improper neutralization of special elements in output used by a downstream component ('injection') i

CVE-2026-85917 - Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate pr

CVE-2026-85889 - Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to

CVE-2026-85885 - Improper neutralization of special elements used in a command ('command injection') in M365 Copilot

CVE-2026-83944 - Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov

CVE-2026-78501 - Improper neutralization of special elements used in a command ('command injection') in Microsoft 365

CVE-2026-77903 - Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate

CVE-2026-70200 - Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a

CVE-2026-70009 - Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows a

CVE-2026-69865 - Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori

CVE-2026-69399 - Azure Arc Elevation of Privilege Vulnerability

CVE-2026-68791 - Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose inform

CVE-2026-65323 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-55946 - Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information ov

CVE-2026-93426 - SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the

CVE-2026-93307 - A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of th

CVE-2026-86688 - Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a

CVE-2026-78668 - Rejected reason: reserved but not needed

CVE-2026-76949 - Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacke

CVE-2026-73639 - Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer rea

CVE-2026-73638 - Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start o

CVE-2026-54767 - WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controlle

CVE-2026-54734 - Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters in

CVE-2026-54671 - WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an

CVE-2026-54670 - WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatc

CVE-2026-54648 - CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customer

CVE-2026-54647 - CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php dir

CVE-2026-54646 - CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php

CVE-2026-54645 - CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/products.index.inc.php rea