CVE-2026-82097 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a

CVE-2026-82095 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a

CVE-2026-82092 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain se

CVE-2026-81941 - IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute

CVE-2026-81940 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra

CVE-2026-81554 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain se

CVE-2026-81551 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrari

CVE-2026-81550 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a

CVE-2026-81540 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite

CVE-2026-81268 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows a

CVE-2026-81265 - IBM Langflow OSS 1.0.0 through 1.11.5.

CVE-2026-81213 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information

CVE-2026-81211 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra

CVE-2026-81210 - IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String

CVE-2026-81207 - IBM DataStage on Cloud Pak for Data 5.4.0.0 allows any authenticated tenant — with no project member

CVE-2026-81204 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to

CVE-2026-80436 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a d

CVE-2026-80434 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulat

CVE-2026-80424 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create ar

CVE-2026-80380 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote attacker to perform unauthorized ac

CVE-2026-80378 - IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a d

CVE-2026-79742 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra

CVE-2026-79725 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary

CVE-2026-79724 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands

CVE-2026-79723 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitiv

CVE-2026-79590 - A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An att

CVE-2026-78575 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra

CVE-2026-78573 - IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrativ

CVE-2026-78571 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra

CVE-2026-78569 - IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary cod

CVE-2026-76059 - IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code coul

CVE-2026-75777 - IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container p

CVE-2026-75624 - IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a

CVE-2026-71647 - An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows

CVE-2026-71645 - An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef12345678

CVE-2026-71643 - An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e2403

CVE-2026-71642 - An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e2403

CVE-2026-71640 - An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e2403

CVE-2026-57844 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-54054 - Transmute is a free, open-source, self-hosted file conversion and compression tool. Prior to version

CVE-2026-49838 - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVE-2026-49837 - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language.

CVE-2026-49836 - psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `

CVE-2026-45770 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45769 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45768 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45767 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45766 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45765 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45764 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45762 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-36392 - FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated admi

CVE-2026-2310 - IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external e

CVE-2026-19646 - IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2

CVE-2025-57231 - Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to

CVE-2026-9667 - IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) th

CVE-2026-9327 - IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege

CVE-2026-9225 - IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensi

CVE-2026-9176 - IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper aut

CVE-2026-89094 - Forgejo before 16.0.4 allows remote code execution via a crafted template repository because templat

CVE-2026-89089 - A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versio

CVE-2026-85025 - IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute ar

CVE-2026-79592 - An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to

CVE-2026-79591 - A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxl

CVE-2026-76653 - A missing authentication vulnerability in the VPN configuration management has been identified in Ar

CVE-2026-76652 - An authenticated directory traversal vulnerability in file upload functionality has been identified

CVE-2026-75940 - A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Ch

CVE-2026-63427 - An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a loca

CVE-2026-45761 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45759 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45752 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45751 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-3096 - The product's web portals allow external links to be opened in a new browser tab. In certain configu

CVE-2026-19596 - An XML External Entity (XXE) vulnerability exists in the XML collector of multiple versions of OpenN

CVE-2026-19136 - A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, dist

CVE-2026-18994 - A potential improper authorization vulnerability was reported in the Lenovo File Manager Android App

CVE-2026-11813 - A potential improper permissions vulnerability was reported in the Lenovo Filez Client application t

CVE-2022-26962 - Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configu

CVE-2026-89087 - The cstruct package before 6.3.0 for OCaml mishandles indexes.

CVE-2026-89086 - In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm

CVE-2026-89054 - A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authen

CVE-2026-89011 - isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo funct

CVE-2026-88062 - OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In

CVE-2026-88061 - career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0,

CVE-2026-84432 - Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog c

CVE-2026-9338 - IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sendin

CVE-2026-9336 - IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a denial of service, caused by sendin

CVE-2026-89049 - A server-side request forgery issue due to improper validation of equivalent address representations

CVE-2026-88060 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-88059 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-88058 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-88057 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-88056 - Angular is a development platform for building mobile and desktop web applications using TypeScript/

CVE-2026-88036 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88035 - A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an u

CVE-2026-88034 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88033 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88032 - A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cau

CVE-2026-88021 - Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh t

CVE-2026-87993 - The consul-template library is vulnerable to an information disclosure issue in its error handling p

CVE-2026-87107 - Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration

CVE-2026-87106 - Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that m

CVE-2026-87090 - Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write pat

CVE-2026-68527 - Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar

CVE-2026-89046 - zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFr

CVE-2026-89045 - zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputS

CVE-2026-89044 - Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to pro

CVE-2026-89043 - passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signat

CVE-2026-89042 - passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional

CVE-2026-88055 - AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe

CVE-2026-88054 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/l

CVE-2026-88053 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in

CVE-2026-88052 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, UNICHARSET::load_via_fgets in

CVE-2026-88051 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, the callback form of GenericVe

CVE-2026-88031 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88030 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88029 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88028 - Improper neutralization of special elements in data query logic in the polymorphic relation handling

CVE-2026-88027 - Improper neutralization of special elements in data query logic in the embedded-document relation ha

CVE-2026-88026 - Improper neutralization of regular-expression metacharacters in the LINQ query translation component

CVE-2026-88025 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88024 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88023 - Improper neutralization of special elements in data query logic in the GridFS component of the Mongo

CVE-2026-88022 - Improper neutralization of special elements in data query logic in the MongoDB integration for Larav

CVE-2026-68006 - An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext

CVE-2026-15419 - In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a

CVE-2026-15418 - In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a

CVE-2026-15417 - In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect

CVE-2026-88050 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, RecodedCharID::DeSerialize in

CVE-2026-88049 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, prior .traineddata hardening a

CVE-2026-88048 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, FullyConnected::DeSerialize in

CVE-2026-88047 - Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadNormProtos in sr

CVE-2026-88046 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88045 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88044 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-85228 - An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from

CVE-2026-73699 - FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated atta

CVE-2026-73698 - FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple admin

CVE-2026-73694 - FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinitio

CVE-2026-73693 - FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handle

CVE-2026-68488 - A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk c

CVE-2026-68487 - Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated cus

CVE-2026-65639 - OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote

CVE-2026-65638 - Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated re

CVE-2026-52098 - An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/predict

CVE-2026-52097 - An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri,

CVE-2026-88959 - Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoi

CVE-2026-88940 - knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, a

CVE-2026-88939 - knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, a

CVE-2026-88938 - knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project ro

CVE-2026-88937 - knowns through 0.33.0 fails to properly validate template destination paths in the code generation t

CVE-2026-88899 - knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in t

CVE-2026-88018 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88017 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88016 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88015 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88014 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88013 - rclone is a command-line program to sync files and directories to and from different cloud storage p

CVE-2026-88012 - Traefik is an open source HTTP reverse proxy and load balancer. From 2.8.2 until 2.11.56 and 3.7.12,

CVE-2026-88011 - Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.56, and from 3.0.0 unt

CVE-2026-88009 - Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefi

CVE-2026-87913 - A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version

CVE-2026-87912 - A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for

CVE-2026-81468 - Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem

CVE-2026-81467 - Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem

CVE-2026-81052 - Dell ThinOS 10, versions prior to 2605_10.2616, contain a Download of Code Without Integrity Check v

CVE-2026-81051 - Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older V

CVE-2026-81049 - Dell ThinOS 10, versions prior to 2605_10.2616, contain a Missing Support for Integrity Check vulner

CVE-2026-81048 - Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elemen

CVE-2026-81046 - Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability

CVE-2026-79987 - A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca

CVE-2026-4130 - There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulner

CVE-2026-4129 - There is an improper access control vulnerability in NI SystemLink that may allow an authenticated u

CVE-2026-88924 - A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownersh

CVE-2026-88898 - AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the

CVE-2026-88897 - Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string p

CVE-2026-88008 - Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.1

CVE-2026-88007 - Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13

CVE-2026-88006 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 unt

CVE-2026-88005 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.0 unt

CVE-2026-88004 - Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik ent

CVE-2026-85310 - import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.

CVE-2026-84821 - Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.

CVE-2026-84819 - Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

CVE-2026-84816 - Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

CVE-2026-81805 - Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions.

CVE-2026-81804 - Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versi

CVE-2026-81803 - Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

CVE-2026-81801 - Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.

CVE-2026-81800 - Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

CVE-2026-81799 - Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 version

CVE-2026-81796 - Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp

CVE-2026-81795 - Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#8211; Lite <= 1.2.3 versions.

CVE-2026-81794 - Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

CVE-2026-81793 - Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allo

CVE-2026-81791 - Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions.

CVE-2026-81789 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stud

CVE-2026-81788 - Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions.

CVE-2026-81787 - Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions.

CVE-2026-81786 - Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions

CVE-2026-81785 - Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions.

CVE-2026-81784 - Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injectio

CVE-2026-81783 - Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.

CVE-2026-81782 - Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions.

CVE-2026-81275 - Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

CVE-2026-78536 - Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions

CVE-2026-66674 - Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.

CVE-2026-66632 - Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.

CVE-2026-46387 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45747 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-15461 - The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_stan

CVE-2026-88921 - MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which i

CVE-2026-88915 - Affected versions of MISP do not consistently enforce the acting user's authorization when instantia

CVE-2026-88896 - EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInterna

CVE-2026-88895 - CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attack

CVE-2026-88894 - Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant

CVE-2026-88893 - OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password

CVE-2026-88892 - In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead

CVE-2026-88891 - OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedu

CVE-2026-88890 - OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that

CVE-2026-88889 - Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that

CVE-2026-88888 - Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processin

CVE-2026-88887 - Renovate is a dependency update automation tool. When listing tags/digests for a container image, Re

CVE-2026-88886 - Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE

CVE-2026-88885 - Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when process

CVE-2026-88884 - Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE

CVE-2026-88883 - Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE

CVE-2026-88882 - Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE

CVE-2026-88881 - Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HT

CVE-2026-88880 - Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagi

CVE-2026-88879 - Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0

CVE-2026-88878 - Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >=

CVE-2026-88877 - Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kuberne

CVE-2026-88876 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vu

CVE-2026-88875 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely s

CVE-2026-88874 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enfor

CVE-2026-88873 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-88872 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery

CVE-2026-88871 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a

CVE-2026-88870 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-88869 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scriptin

CVE-2026-88868 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scriptin

CVE-2026-88867 - WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contai

CVE-2026-88866 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scr

CVE-2026-88865 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership

CVE-2026-88864 - Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed th

CVE-2026-88863 - capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank aga

CVE-2026-88862 - Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing

CVE-2026-88861 - Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched versio

CVE-2026-88860 - Capgo fails to clean up channel permission overrides when a user's last organization role binding is