CVE-2026-92953 - vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes fr

CVE-2026-92952 - vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across th

CVE-2026-92951 - vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlis

CVE-2026-92950 - vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to e

CVE-2026-92949 - vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on fro

CVE-2026-92948 - vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a

CVE-2026-92947 - vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m

CVE-2026-92946 - vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi

CVE-2026-92945 - vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that us

CVE-2026-92944 - vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promis

CVE-2026-92942 - vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code

CVE-2026-92941 - vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a

CVE-2026-92940 - vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod

CVE-2026-92939 - vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto

CVE-2026-92938 - vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeV

CVE-2026-92937 - vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js pr

CVE-2026-92936 - vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through err

CVE-2026-92935 - vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM

CVE-2026-92934 - vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape

CVE-2026-92933 - vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host

CVE-2026-92879 - A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_

CVE-2026-90986 - Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 vers

CVE-2026-90887 - Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions.

CVE-2026-89418 - google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attac

CVE-2026-86533 - Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthenticatio

CVE-2026-86522 - Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an un

CVE-2026-85500 - Authentication Bypass by Primary Weakness vulnerability in team-alembic AshAuthentication allows an

CVE-2026-82761 - Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication al

CVE-2026-82760 - Inefficient Algorithmic Complexity vulnerability in team-alembic AshAuthentication allows an unauthe

CVE-2026-82759 - Use of a One-Way Hash with a Predictable Salt vulnerability in team-alembic AshAuthentication allows

CVE-2026-82723 - Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication all

CVE-2026-82685 - Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication all

CVE-2026-81829 - A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON W

CVE-2026-81637 - Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker w

CVE-2026-81632 - Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoen

CVE-2026-81453 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of

CVE-2026-81443 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request For

CVE-2026-81442 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Man

CVE-2026-80355 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forg

CVE-2026-80218 - Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker holding a

CVE-2026-78528 - Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.

CVE-2026-78295 - Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43 versions.

CVE-2026-78294 - Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

CVE-2026-78223 - Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication all

CVE-2026-74017 - Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.

CVE-2026-74005 - Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.

CVE-2026-74002 - Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

CVE-2026-74000 - Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

CVE-2026-73999 - Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

CVE-2026-71568 - In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploitin

CVE-2026-66676 - Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.

CVE-2026-66631 - Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

CVE-2026-66630 - Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

CVE-2026-66628 - Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

CVE-2026-66626 - Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

CVE-2026-66625 - Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

CVE-2026-66624 - Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

CVE-2026-66619 - Administrator SQL Injection in Newsletters <= 4.18 versions.

CVE-2026-66618 - Administrator SQL Injection in WP Maps <= 4.9.9 versions.

CVE-2026-66617 - Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

CVE-2026-66608 - Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Ad

CVE-2026-66580 - Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

CVE-2026-66579 - Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

CVE-2026-66578 - Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

CVE-2026-66577 - Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

CVE-2026-66576 - Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

CVE-2026-66575 - Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 ver

CVE-2026-66574 - Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.

CVE-2026-66573 - Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.

CVE-2026-66572 - Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.

CVE-2026-66571 - Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 ve

CVE-2026-62108 - Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions.

CVE-2026-62104 - Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.

CVE-2026-62101 - Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions.

CVE-2026-14850 - The password reset funcionality is vulnerable to unauthorized account modification due to improper v

CVE-2026-92932 - In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php conta

CVE-2026-92921 - admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt

CVE-2026-92920 - admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing a

CVE-2026-92919 - admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing aut

CVE-2026-92918 - admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLo

CVE-2026-92904 - A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_

CVE-2026-81481 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of

CVE-2026-53681 - Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVE-2026-92925 - A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, P

CVE-2026-92917 - Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to re

CVE-2026-92916 - Grav is a flat-file CMS. In Grav 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21, when the debugger

CVE-2026-92915 - WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control

CVE-2026-92914 - AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verific

CVE-2026-92913 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-

CVE-2026-92912 - AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values

CVE-2026-92860 - A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issu

CVE-2026-90823 - FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 con

CVE-2026-90822 - FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 con

CVE-2026-81480 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Over

CVE-2026-81479 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparis

CVE-2026-81478 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Crypt

CVE-2026-81477 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overf

CVE-2026-81476 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Neutralizatio

CVE-2026-81475 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication

CVE-2026-81441 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication

CVE-2026-81440 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Crede

CVE-2026-78296 - Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows

CVE-2026-53679 - Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVE-2026-11874 - Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.

CVE-2026-92903 - Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-control

CVE-2026-92893 - A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its ho

CVE-2026-92611 - In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface

CVE-2026-81474 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overf

CVE-2026-81439 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorizatio

CVE-2026-81438 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky

CVE-2026-66269 - Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Contr

CVE-2026-92894 - A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action res

CVE-2026-78428 - For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one

CVE-2026-78427 - The NeuVector admission webhook silently excludes containers from policy evaluation when their image

CVE-2026-78426 - The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field.

CVE-2026-78425 - Authorised users of outside applications behind the same corporate identity provider (IdP), for exam

CVE-2026-50610 - A vulnerability has been identified in the Acer System Monitoring component included with NitroSense

CVE-2026-50609 - A vulnerability has been identified in the Acer System Monitoring component included with NitroSense

CVE-2026-50608 - A vulnerability has been identified in the Acer System Monitoring component included with NitroSense

CVE-2026-15688 - Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3

CVE-2026-87831 - The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not

CVE-2026-87829 - The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not

CVE-2026-86320 - A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources wit

CVE-2026-50607 - A vulnerability has been identified in the Acer System Monitoring component included with NitroSense

CVE-2026-50606 - A vulnerability has been identified in the Acer System Monitoring component included with NitroSense

CVE-2026-50605 - A vulnerability has been identified in the Acer Agent Service component included with NitroSense and

CVE-2026-91017 - The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the auth

CVE-2026-90982 - @fastify/static is a Fastify plugin that serves static files from a configured root directory. In ve

CVE-2026-87963 - The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username reques

CVE-2026-86801 - The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does n

CVE-2026-44940 - The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain con

CVE-2026-91019 - The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can v

CVE-2026-91016 - The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a u

CVE-2026-91015 - The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization che

CVE-2026-91014 - The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise an

CVE-2026-91011 - The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute valu

CVE-2026-91010 - The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.

CVE-2026-91009 - The Active Woot Products Tables for WooCommerce. 100% FREE  WordPress plugin before 2.1.3 does not h

CVE-2026-91008 - The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownersh

CVE-2026-90923 - The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callb

CVE-2026-90922 - The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and

CVE-2026-88904 - The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST rou

CVE-2026-88795 - The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authenticat

CVE-2026-88792 - The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in

CVE-2026-87836 - The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to u

CVE-2026-87786 - The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at che

CVE-2026-86824 - The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with

CVE-2026-86788 - The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name

CVE-2026-86710 - The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in

CVE-2026-86709 - The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session

CVE-2026-86707 - The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate

CVE-2026-86446 - The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns whe

CVE-2026-85130 - The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a p

CVE-2026-85128 - The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role reques

CVE-2025-15697 - The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in

CVE-2026-87935 - The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to

CVE-2026-87796 - The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in

CVE-2026-50604 - A vulnerability has been identified in the Acer Agent Service component included with NitroSense and

CVE-2026-25294 - Transient DOS while parsing frame during channel usage.

CVE-2026-25290 - Memory Corruption when validating large data buffers from external sources using addition to check b

CVE-2026-25284 - Information Disclosure when a pointer is reused after being deallocated.

CVE-2026-25283 - Memory Corruption when copying unverified data from an external source exceeds the allocated buffer

CVE-2026-25282 - Transient DOS when processing unverified data from a neighboring system causes out of bound memory a

CVE-2026-25281 - Transient DOS when processing large or numerous request buffers without sufficient memory allocation

CVE-2026-25280 - Memory corruption when processing escape handling flow with insufficient user buffer sizes.

CVE-2026-25278 - Memory Corruption when processing I2C transfer requests due to a race condition between memory alloc

CVE-2026-25275 - Transient DOS when processing authentication frames with invalid FILS information element header len

CVE-2026-25261 - Memory corruption while processing rear sensor IOCTL calls.

CVE-2026-24081 - Transient DOS when processing a channel map with insufficient used channels and adaptive frequency h

CVE-2026-24075 - Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handle

CVE-2026-24074 - Memory Corruption when processing data with large offset and length values exceeds buffer limits dur

CVE-2026-24073 - Memory corruption when processing decode statistics due to insufficient validation of offset against

CVE-2025-59607 - Memory Corruption when copying large input data exceeds normal allocation limits.

CVE-2026-92839 - Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor coul

CVE-2026-86311 - The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Sto

CVE-2026-50603 - A vulnerability has been identified in the Acer Agent Service component included with NitroSense and

CVE-2026-89064 - The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential

CVE-2026-92838 - A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The appli

CVE-2026-81546 - The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bou

CVE-2026-85789 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-65388 - A remote attacker who controls a container registry may be able to direct a client's token request t

CVE-2026-61599 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61596 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61589 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61588 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-92599 - joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to r

CVE-2026-92598 - Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names

CVE-2026-92597 - Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/add

CVE-2026-92596 - Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser comp

CVE-2026-92595 - Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess

CVE-2026-92594 - Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator an

CVE-2026-92593 - Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controll

CVE-2026-92592 - Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-contr

CVE-2026-92591 - Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not in

CVE-2026-92590 - Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in

CVE-2026-92589 - Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nest

CVE-2026-92588 - n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the sour

CVE-2026-92587 - n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node

CVE-2026-92586 - AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access p

CVE-2026-92585 - AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access

CVE-2026-92584 - AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerabilit

CVE-2026-92583 - AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomi

CVE-2026-92582 - AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. ob

CVE-2026-92581 - In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before

CVE-2026-92580 - In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin

CVE-2026-92579 - In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basen

CVE-2026-92578 - WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password h

CVE-2026-92577 - In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerabilit

CVE-2026-92576 - HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool

CVE-2026-89034 - TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthentica

CVE-2026-85469 - A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upst

CVE-2026-64684 - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's Stream

CVE-2026-61597 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61594 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61592 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-61591 - djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe

CVE-2026-92816 - ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers

CVE-2026-92815 - changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing u

CVE-2026-92814 - changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allo

CVE-2026-92813 - Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSO

CVE-2026-92812 - decap-server contains a path traversal vulnerability in the local proxy containment guard that uses

CVE-2026-92811 - browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright

CVE-2026-92810 - PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishLis

CVE-2026-92809 - PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attribut

CVE-2026-92806 - phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscr

CVE-2026-92805 - UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wiza

CVE-2026-92804 - Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated

CVE-2026-92803 - LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing

CVE-2026-92802 - kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import

CVE-2026-92801 - cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler f

CVE-2026-92800 - Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoke

CVE-2026-92796 - Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in mu

CVE-2026-92795 - Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, a

CVE-2026-92794 - OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one

CVE-2026-92793 - GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowi

CVE-2026-92792 - OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied

CVE-2026-92791 - Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing

CVE-2026-92790 - Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing

CVE-2026-92789 - Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails

CVE-2026-92788 - Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes bel

CVE-2026-92787 - Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowin

CVE-2026-92786 - LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allo

CVE-2026-92785 - Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registrat

CVE-2026-92784 - @refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into gen

CVE-2026-92783 - Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, a

CVE-2026-92782 - Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allo

CVE-2026-92781 - Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability

CVE-2026-92780 - KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowi

CVE-2026-92779 - Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability

CVE-2026-92778 - CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes