CVE-2026-18175 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due t

CVE-2026-18078 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic

CVE-2026-18076 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic

CVE-2026-18073 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a

CVE-2026-17631 - IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-17627 - IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-17622 - IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-17621 - IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the s

CVE-2026-17499 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to impro

CVE-2026-17483 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical fligh

CVE-2026-17470 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buf

CVE-2026-17469 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service

CVE-2026-17444 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-17443 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-17442 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-17440 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-17274 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-17273 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic

CVE-2026-17270 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to a stac

CVE-2026-17259 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic

CVE-2026-17255 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro

CVE-2026-17207 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromi

CVE-2026-17057 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and affect d

CVE-2026-16941 - IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system message

CVE-2026-16892 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict

CVE-2026-16826 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to impro

CVE-2026-16693 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-16689 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-16660 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service du

CVE-2026-16180 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-14470 - IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories

CVE-2026-14350 - IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to i

CVE-2026-13297 - IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure at

CVE-2026-85730 - smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can ente

CVE-2026-82911 - Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number}

CVE-2026-80864 - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on

CVE-2026-80863 - In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_at

CVE-2026-80862 - In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix usage of page_fra

CVE-2026-80861 - In the Linux kernel, the following vulnerability has been resolved: usb: xhci: bail out of setup if

CVE-2026-80860 - In the Linux kernel, the following vulnerability has been resolved: fuse: fix race between interrup

CVE-2026-80859 - In the Linux kernel, the following vulnerability has been resolved: fuse: fix missing barrier when

CVE-2026-80858 - In the Linux kernel, the following vulnerability has been resolved: fuse: publish io-uring queues w

CVE-2026-80857 - In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on a

CVE-2026-80856 - In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak

CVE-2026-80855 - In the Linux kernel, the following vulnerability has been resolved: fuse: fix invalidate lock leak

CVE-2026-80854 - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: keep port c

CVE-2026-80853 - In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages f

CVE-2026-80852 - In the Linux kernel, the following vulnerability has been resolved: tls: device: fix out-of-bounds

CVE-2026-80851 - In the Linux kernel, the following vulnerability has been resolved: gtp: serialize PDP context upda

CVE-2026-80850 - In the Linux kernel, the following vulnerability has been resolved: tcp: fix AO info use-after-free

CVE-2026-80849 - In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free

CVE-2026-80848 - In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during

CVE-2026-80847 - In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP_

CVE-2026-80846 - In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets w

CVE-2026-80845 - In the Linux kernel, the following vulnerability has been resolved: xfrm: avoid lock inversion in n

CVE-2026-80844 - In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing hea

CVE-2026-80843 - In the Linux kernel, the following vulnerability has been resolved: xfrm: fix xfrm_state_construct(

CVE-2026-80842 - In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-aft

CVE-2026-80841 - In the Linux kernel, the following vulnerability has been resolved: net/packet: defer vmalloc TX_RI

CVE-2026-80840 - In the Linux kernel, the following vulnerability has been resolved: ipv6: seg6: clear IPv4 control

CVE-2026-80839 - In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject unrepresenta

CVE-2026-80838 - In the Linux kernel, the following vulnerability has been resolved: vxlan: keep the last remote lin

CVE-2026-80837 - In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't que

CVE-2026-80836 - In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - bound the akci

CVE-2026-80835 - In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove crypt

CVE-2026-80834 - In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove crypt

CVE-2026-80833 - In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ss - Remove crypt

CVE-2026-80832 - In the Linux kernel, the following vulnerability has been resolved: crypto: qce - fix CCM AAD buffe

CVE-2026-80831 - In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source sc

CVE-2026-80830 - In the Linux kernel, the following vulnerability has been resolved: usb: core: Add lock to usb_wake

CVE-2026-80829 - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write

CVE-2026-80828 - In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete clean

CVE-2026-80827 - In the Linux kernel, the following vulnerability has been resolved: USB: serial: option: fix slab O

CVE-2026-80826 - In the Linux kernel, the following vulnerability has been resolved: USB: c67x00: fix use-after-free

CVE-2026-80825 - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: ensure tx h

CVE-2026-80824 - In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free

CVE-2026-80823 - In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate ATR_REQ

CVE-2026-80822 - In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null

CVE-2026-80821 - In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on c

CVE-2026-80820 - In the Linux kernel, the following vulnerability has been resolved: xfs: don't livelock in scrub on

CVE-2026-80819 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcomm_

CVE-2026-80818 - In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix CMD_S

CVE-2026-80817 - In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix NULL pointer

CVE-2026-80816 - In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Use a private URB fo

CVE-2026-80815 - In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Use a private

CVE-2026-80814 - In the Linux kernel, the following vulnerability has been resolved: rndis_host: add overflow check

CVE-2026-80813 - In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer derefer

CVE-2026-80812 - In the Linux kernel, the following vulnerability has been resolved: ALSA: dummy: Check card index v

CVE-2026-80811 - In the Linux kernel, the following vulnerability has been resolved: io_uring/cmd: fix iovec leak wh

CVE-2026-80810 - In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio size o

CVE-2026-80809 - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata res

CVE-2026-80808 - In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated x

CVE-2026-80807 - In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block in

CVE-2026-80806 - In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new e

CVE-2026-80805 - In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointe

CVE-2026-80804 - In the Linux kernel, the following vulnerability has been resolved: xfs: restore nofs context uncon

CVE-2026-80803 - In the Linux kernel, the following vulnerability has been resolved: nfc: digital: clamp SENSF_RES l

CVE-2026-80802 - In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: bound the device-repo

CVE-2026-80801 - In the Linux kernel, the following vulnerability has been resolved: nfc: microread: validate target

CVE-2026-80800 - In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: bound the connect_sn

CVE-2026-80799 - In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix OOB read and u8

CVE-2026-80798 - In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: reject PDUs shorter

CVE-2026-80797 - In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: purge fragmented sk

CVE-2026-80796 - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add data_len bound ch

CVE-2026-80795 - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix out-of-bounds wri

CVE-2026-80794 - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: fix uninit-value in t

CVE-2026-80793 - In the Linux kernel, the following vulnerability has been resolved: ipv4: reject undersized MTUs in

CVE-2026-80792 - In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6

CVE-2026-80791 - In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: zero the AUTH_RECEI

CVE-2026-80790 - In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: fix invalid free in L

CVE-2026-80789 - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data lengt

CVE-2026-80788 - In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Do not WARN on remot

CVE-2026-80787 - In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: fix use-after-f

CVE-2026-80786 - In the Linux kernel, the following vulnerability has been resolved: fbdev: Wrap user-invoked calls

CVE-2026-80785 - In the Linux kernel, the following vulnerability has been resolved: fbdev: serialize mode sysfs acc

CVE-2026-80784 - In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from

CVE-2026-80783 - In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: prevent unboun

CVE-2026-80782 - In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: do not keep a

CVE-2026-80781 - In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of fiel

CVE-2026-80780 - In the Linux kernel, the following vulnerability has been resolved: HID: pidff: fix OOB write when

CVE-2026-80779 - In the Linux kernel, the following vulnerability has been resolved: net/ionic: avoid OOB TX partner

CVE-2026-80778 - In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm priva

CVE-2026-80777 - In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex ex

CVE-2026-80776 - In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futex_pivot_

CVE-2026-80775 - In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial

CVE-2026-80774 - In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix missing hid_is_u

CVE-2026-80773 - In the Linux kernel, the following vulnerability has been resolved: HID: huawei: fix missing hid_is

CVE-2026-80772 - In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix out-of-bound

CVE-2026-80771 - In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: register input d

CVE-2026-80770 - In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: stop device IO b

CVE-2026-80769 - In the Linux kernel, the following vulnerability has been resolved: HID: rapoo: fix missing hid_is_

CVE-2026-80768 - In the Linux kernel, the following vulnerability has been resolved: HID: ft260: fix stack-use-after

CVE-2026-80767 - In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix use-af

CVE-2026-80766 - In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: fix use-after-fre

CVE-2026-80765 - In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial d

CVE-2026-80764 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: fix LE li

CVE-2026-80763 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate

CVE-2026-80762 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix accept

CVE-2026-80761 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: zero the sockad

CVE-2026-80760 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject HCI_CMD

CVE-2026-80759 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_aml: validate fi

CVE-2026-80758 - In the Linux kernel, the following vulnerability has been resolved: futex: Avoid private hash use-a

CVE-2026-79419 - A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suit

CVE-2026-79418 - EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in

CVE-2026-78970 - JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiControlle

CVE-2026-78658 - IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.25, and 7.3 through 7.3.2.20 and IBM UCD - IBM DevO

CVE-2026-78543 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-77822 - IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive informa

CVE-2026-75431 - PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-base

CVE-2026-75429 - PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability i

CVE-2026-75171 - An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID sessi

CVE-2026-75170 - Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore pla

CVE-2026-75169 - An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway fi

CVE-2026-75168 - An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware

CVE-2026-75167 - A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solut

CVE-2026-75166 - Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-

CVE-2026-75165 - An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote a

CVE-2026-75164 - An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway fi

CVE-2026-75163 - An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-S

CVE-2026-75162 - An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in

CVE-2026-75161 - An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware

CVE-2026-75160 - An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via th

CVE-2026-5522 - IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a passw

CVE-2026-44402 - Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in

CVE-2026-19649 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-19645 - IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie ca

CVE-2026-19306 - IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from

CVE-2026-19305 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information

CVE-2026-19304 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-19303 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrar

CVE-2026-19302 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-19301 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-19300 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information

CVE-2026-19299 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-19298 - IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitra

CVE-2026-19283 - IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul

CVE-2026-19274 - IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator coul

CVE-2026-18905 - IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a

CVE-2026-18887 - IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information i

CVE-2026-18858 - IBM i 7.6, and 7.5 could allow a local authenticated attacker to obtain information from a privilege

CVE-2026-18658 - IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.

CVE-2026-18567 - IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a r

CVE-2022-35499 - In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site

CVE-2022-35497 - In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible

CVE-2026-9186 - IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only

CVE-2026-9138 - IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitr

CVE-2026-8447 - IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the

CVE-2026-85700 - Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, al

CVE-2026-85699 - jina-ai reader contains a server-side request forgery vulnerability where URL validation is performe

CVE-2026-85698 - Turso through 0.8.0-pre.8 contains an out-of-bounds read vulnerability in the table-leaf page reader

CVE-2026-85697 - Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to

CVE-2026-85696 - SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded

CVE-2026-85695 - FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allow

CVE-2026-85694 - LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract

CVE-2026-85693 - Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows auth

CVE-2026-85692 - Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side

CVE-2026-85691 - MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /

CVE-2026-85690 - Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attacke

CVE-2026-85689 - llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/reso

CVE-2026-85688 - TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the

CVE-2026-85687 - surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the

CVE-2026-85686 - ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compa

CVE-2026-85685 - AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill t

CVE-2026-85684 - marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler t

CVE-2026-85676 - Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on eve

CVE-2026-85675 - OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_

CVE-2026-85674 - aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git

CVE-2026-85673 - LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API mult

CVE-2026-85672 - zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the

CVE-2026-85671 - QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_ba

CVE-2026-85670 - tokenizers (Hugging Face) is affected by an out-of-bounds buffer access in BpeBuilder::build (tokeni

CVE-2026-85669 - potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/cod

CVE-2026-85668 - Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vuln

CVE-2026-85667 - xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints

CVE-2026-85666 - OGX (formerly Llama Stack, affected at commit fbe8e0f) contains an unauthenticated server-side reque

CVE-2026-85665 - Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing atta

CVE-2026-85664 - Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_constructio

CVE-2026-85663 - Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods th

CVE-2026-85662 - Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that

CVE-2026-85661 - excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unse

CVE-2026-85660 - cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the _validate_command_with

CVE-2026-85651 - Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operatio

CVE-2026-85650 - Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert chann

CVE-2026-85626 - git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters

CVE-2026-85625 - sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, a

CVE-2026-85624 - Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList pr

CVE-2026-85623 - goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without secur

CVE-2026-85622 - AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket con

CVE-2026-85621 - LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ

CVE-2026-85620 - Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validatio

CVE-2026-85619 - AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in autho

CVE-2026-85618 - ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows a

CVE-2026-85608 - Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the

CVE-2026-85607 - Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (mess

CVE-2026-85606 - firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_par

CVE-2026-85605 - Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthen

CVE-2026-82729 - Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to

CVE-2026-82728 - Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remo

CVE-2026-81859 - CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to t

CVE-2026-81832 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integr

CVE-2026-6958 - Acunetix 25.11.251107123 for Windows contains a local privilege escalation vulnerability in the Web

CVE-2026-19727 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-19205 - Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Fo

CVE-2026-14466 - It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vuln

CVE-2026-85522 - A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability i

CVE-2026-85517 - A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unk

CVE-2026-77818 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-52691 - ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command (

CVE-2026-19081 - Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Acce

CVE-2026-19057 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i