CVE-2026-46387 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-45747 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-15461 - The Sierra Wireless HL78xx modem GNSS driver (drivers/modem/hl78xx/, later drivers/modem/vendor_stan

CVE-2026-88921 - MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which i

CVE-2026-88915 - Affected versions of MISP do not consistently enforce the acting user's authorization when instantia

CVE-2026-88896 - EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInterna

CVE-2026-88895 - CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attack

CVE-2026-88894 - Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant

CVE-2026-88893 - OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password

CVE-2026-88892 - In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead

CVE-2026-88891 - OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedu

CVE-2026-88890 - OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that

CVE-2026-88889 - Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that

CVE-2026-88888 - Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processin

CVE-2026-88887 - Renovate is a dependency update automation tool. When listing tags/digests for a container image, Re

CVE-2026-88886 - Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE

CVE-2026-88885 - Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when process

CVE-2026-88884 - Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE

CVE-2026-88883 - Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE

CVE-2026-88882 - Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE

CVE-2026-88881 - Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HT

CVE-2026-88880 - Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagi

CVE-2026-88879 - Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0

CVE-2026-88878 - Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >=

CVE-2026-88877 - Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kuberne

CVE-2026-88876 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vu

CVE-2026-88875 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely s

CVE-2026-88874 - AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enfor

CVE-2026-88873 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-88872 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery

CVE-2026-88871 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a

CVE-2026-88870 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo

CVE-2026-88869 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scriptin

CVE-2026-88868 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scriptin

CVE-2026-88867 - WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contai

CVE-2026-88866 - WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scr

CVE-2026-88865 - AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership

CVE-2026-88864 - Capgo (capgo.app) fails to restrict direct write access to the public.sso_providers table exposed th

CVE-2026-88863 - capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank aga

CVE-2026-88862 - Capgo (capgo.app) backend through 12.242.4 does not validate parent-child delegation when processing

CVE-2026-88861 - Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched versio

CVE-2026-88860 - Capgo fails to clean up channel permission overrides when a user's last organization role binding is

CVE-2026-88790 - A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function

CVE-2026-85217 - A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify per

CVE-2026-75584 - ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remo

CVE-2026-6285 - Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Tech

CVE-2026-64838 - ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and r

CVE-2026-64837 - ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php,

CVE-2026-64836 - ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint du

CVE-2026-45763 - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M

CVE-2026-38626 - Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.p

CVE-2026-12683 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-12682 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-9166 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in GIS

CVE-2026-9163 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-9161 - Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprin

CVE-2026-88038 - cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In v

CVE-2026-85545 - There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege us

CVE-2026-85544 - Some Hikvision intercom products utilize an immutable factory value which should be obtained from lo

CVE-2026-85543 - Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, all

CVE-2026-17038 - DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. Thes

CVE-2026-88859 - A flaw was found in Evolution. A remote attacker can exploit this vulnerability by sending a special

CVE-2026-84828 - A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'h

CVE-2026-87962 - t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromByt

CVE-2026-87961 - ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in

CVE-2026-78085 - Joomla Extension - joomshaper.com - Path Traversal in Gallery Image Management in SP Property < 4.1.

CVE-2026-87803 - An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeli

CVE-2026-78374 - Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder exten

CVE-2026-78303 - Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Req

CVE-2026-78302 - Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped

CVE-2026-78084 - Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Propert

CVE-2026-78083 - Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Co

CVE-2026-78082 - Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filteri

CVE-2026-5399 - The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider

CVE-2026-15889 - The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Po

CVE-2026-8323 - URL redirection to untrusted site ('open redirect') vulnerability in Armiya Information Technologies

CVE-2026-88290 - GeoVision GV-LPC2211 V1.14 (260903) allows unauthenticated clients to declare unbounded VLSVR frame

CVE-2026-88289 - GeoVision GV-LPC2211 V1.14 (260903) fails to validate attacker-controlled variable-length fields bef

CVE-2026-88288 - GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a

CVE-2026-88287 - GeoVision GV-LPC2211 V1.13 fails to bound the number of Scopes tokens in unauthenticated ONVIF WS-Di

CVE-2026-88286 - GeoVision GV-LPC2211 V1.13 improperly manages PTZ connection state, allowing an unauthenticated remo

CVE-2026-88285 - GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication,

CVE-2026-88284 - GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF SetUser requests, allowing

CVE-2026-88283 - GeoVision GV-LPC2211 V1.13 fails to limit repeated User elements in ONVIF CreateUsers requests, allo

CVE-2026-88282 - GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metachar

CVE-2026-88281 - GeoVision GV-LPC2211 V1.13 fails to limit repeated Username elements in ONVIF DeleteUsers requests,

CVE-2026-88280 - GeoVision GV-LPC2211 V1.13 copies an oversized ONVIF SetUser password into a fixed stack field, allo

CVE-2026-88279 - GeoVision GV-LPC2211 V1.13 copies oversized ONVIF CreateUsers username or password values into fixed

CVE-2026-88278 - GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse prote

CVE-2026-88277 - GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through Consu

CVE-2026-88276 - GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to

CVE-2026-88275 - GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to exe

CVE-2026-88274 - GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax

CVE-2026-88273 - GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced she

CVE-2026-88272 - GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacte

CVE-2026-88271 - GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the adm

CVE-2026-88270 - GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live

CVE-2026-88269 - GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containin

CVE-2026-88268 - GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassemb

CVE-2026-88265 - A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and a

CVE-2026-88264 - A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, ter

CVE-2026-84042 - A flaw was found in crun. When crun is built with libkrun and a container is started rootful with pa

CVE-2026-59679 - fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character enc

CVE-2026-44950 - fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) copies each glyph's bitmap in

CVE-2026-42808 - An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11.  The host stream

CVE-2026-42807 - A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINE

CVE-2026-42806 - An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in versi

CVE-2026-42805 - A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C librar

CVE-2026-42804 - A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library

CVE-2026-13745 - A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code

CVE-2026-88770 - A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access manageme

CVE-2026-88763 - A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to p

CVE-2026-80354 - Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorizatio

CVE-2026-80352 - Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML

CVE-2026-80351 - Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability

CVE-2026-7188 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-87804 - Rejected reason: no security impact

CVE-2026-82925 - The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized

CVE-2026-82582 - An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may a

CVE-2026-81635 - A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an

CVE-2026-81431 - The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form

CVE-2026-78361 - The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform

CVE-2026-77771 - The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does

CVE-2026-77770 - The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does

CVE-2026-19840 - The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX a

CVE-2026-19439 - The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisati

CVE-2026-19436 - The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value

CVE-2026-0304 - A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authentic

CVE-2026-0303 - A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary co

CVE-2026-0302 - An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local

CVE-2026-85645 - The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v

CVE-2026-84939 - Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can sp

CVE-2026-82079 - A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functio

CVE-2026-0310 - A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® so

CVE-2026-0309 - A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad

CVE-2026-0308 - A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a m

CVE-2026-0307 - Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app all

CVE-2026-0306 - A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma®

CVE-2026-0305 - An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enab

CVE-2026-75880 - An authenticated client could attach a consumer with a selector containing crafted wildcard usage th

CVE-2026-67593 - A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a qu

CVE-2026-57967 - An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an exi

CVE-2026-57822 - When the broker is processing message-based management requests, sent by an authenticated messaging

CVE-2026-49364 - An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrativ

CVE-2026-49363 - An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node detai

CVE-2026-49362 - An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leadin

CVE-2026-76562 - The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

CVE-2026-4657 - The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cont

CVE-2026-18594 - The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all ver

CVE-2026-18386 - The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all v

CVE-2026-15823 - The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of dat

CVE-2026-15820 - The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via P

CVE-2026-15796 - The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '

CVE-2026-15019 - The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all

CVE-2026-14873 - The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeo

CVE-2026-87870 - The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

CVE-2026-84063 - BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous t

CVE-2026-84062 - BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled

CVE-2026-19584 - Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature

CVE-2026-19583 - Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the

CVE-2026-18351 - The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary Fi

CVE-2026-87933 - A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJS

CVE-2026-87931 - A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearabl

CVE-2026-87926 - A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c7

CVE-2026-87925 - A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc

CVE-2026-87924 - A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d0

CVE-2026-87923 - A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5

CVE-2026-71809 - Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-se

CVE-2026-15460 - The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/cla

CVE-2026-88069 - Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a

CVE-2026-88002 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 unt

CVE-2026-88001 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 unt

CVE-2026-88000 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87999 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.

CVE-2026-87998 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87997 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87996 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 unt

CVE-2026-87995 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 un

CVE-2026-87994 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 unt

CVE-2026-87922 - A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9

CVE-2026-87921 - A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5

CVE-2026-87017 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 unt

CVE-2026-87016 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 un

CVE-2026-75308 - yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of

CVE-2026-75307 - zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipm

CVE-2026-71807 - In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskControl

CVE-2026-71805 - An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated

CVE-2026-15913 - In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of For

CVE-2026-87015 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 un

CVE-2026-87014 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-87013 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87012 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-87011 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-79522 - An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0

CVE-2026-79516 - An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3

CVE-2026-79515 - An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows att

CVE-2026-79514 - An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows att

CVE-2026-79513 - A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_c

CVE-2026-79387 - SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to

CVE-2026-71808 - A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attac

CVE-2026-71803 - money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, t

CVE-2026-71802 - A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of RE

CVE-2026-71801 - An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded defa

CVE-2026-53956 - Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_ca

CVE-2026-50165 - alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet

CVE-2026-36433 - An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically pr

CVE-2026-87911 - An OS command injection weakness in the read-only enforcement of the SQL validation component in Ama

CVE-2026-79324 - Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/mo

CVE-2026-73789 - A vulnerability in the web-based management interface of CPPM guest account management services coul

CVE-2026-73788 - A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to eleva

CVE-2026-73787 - A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access dir

CVE-2026-73786 - A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote

CVE-2026-73769 - A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an auth

CVE-2026-71616 - An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of se

CVE-2026-71614 - An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary co

CVE-2026-71613 - Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to

CVE-2026-71612 - Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to

CVE-2026-61915 - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authe

CVE-2026-61911 - An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An a

CVE-2026-61910 - An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use r

CVE-2026-61909 - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL

CVE-2026-61908 - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an ou

CVE-2026-38998 - A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of L

CVE-2026-79323 - Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (mage

CVE-2026-79322 - SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-

CVE-2026-61907 - An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox AC

CVE-2026-54694 - SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code fl

CVE-2026-52482 - An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensiti

CVE-2026-39020 - An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavef

CVE-2025-51619 - A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivi

CVE-2026-8044 - CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerabi

CVE-2026-87930 - MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions,

CVE-2026-87929 - MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config

CVE-2026-87928 - MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_pa

CVE-2026-87927 - MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxs

CVE-2026-87876 - Two case-insensitive comparisons on request-derived usernames outside the main authorization path in

CVE-2026-87875 - The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read p

CVE-2026-87874 - A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although

CVE-2026-87872 - A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible c

CVE-2026-87853 - A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compare

CVE-2026-85788 - Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-m

CVE-2026-80925 - In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and r

CVE-2026-80924 - In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensit

CVE-2026-80923 - In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on

CVE-2026-80922 - In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero a

CVE-2026-80921 - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale cry

CVE-2026-80920 - In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signali

CVE-2026-80919 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mu

CVE-2026-80918 - In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer t

CVE-2026-80917 - In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL poi