CVE-2026-15796 - The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '

CVE-2026-15019 - The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all

CVE-2026-14873 - The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeo

CVE-2026-87870 - The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

CVE-2026-84063 - BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous t

CVE-2026-84062 - BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled

CVE-2026-19584 - Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature

CVE-2026-19583 - Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the

CVE-2026-18351 - The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary Fi

CVE-2026-87933 - A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJS

CVE-2026-87931 - A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearabl

CVE-2026-87926 - A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c7

CVE-2026-87925 - A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc

CVE-2026-87924 - A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d0

CVE-2026-87923 - A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5

CVE-2026-71809 - Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-se

CVE-2026-15460 - The Bluetooth Classic (BR/EDR) L2CAP receive handler bt_l2cap_br_recv() in subsys/bluetooth/host/cla

CVE-2026-88069 - Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a

CVE-2026-88002 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 unt

CVE-2026-88001 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 unt

CVE-2026-88000 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87999 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.

CVE-2026-87998 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87997 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87996 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 unt

CVE-2026-87995 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 un

CVE-2026-87994 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 unt

CVE-2026-87922 - A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9

CVE-2026-87921 - A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5

CVE-2026-87017 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 unt

CVE-2026-87016 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 un

CVE-2026-75308 - yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload of

CVE-2026-75307 - zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipm

CVE-2026-71807 - In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskControl

CVE-2026-71805 - An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated

CVE-2026-15913 - In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of For

CVE-2026-87015 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 un

CVE-2026-87014 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-87013 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un

CVE-2026-87012 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-87011 - Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt

CVE-2026-79522 - An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0

CVE-2026-79516 - An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3

CVE-2026-79515 - An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows att

CVE-2026-79514 - An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows att

CVE-2026-79513 - A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_c

CVE-2026-79387 - SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to

CVE-2026-71808 - A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attac

CVE-2026-71803 - money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, t

CVE-2026-71802 - A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of RE

CVE-2026-71801 - An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded defa

CVE-2026-53956 - Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_ca

CVE-2026-50165 - alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet

CVE-2026-36433 - An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically pr

CVE-2026-87911 - An OS command injection weakness in the read-only enforcement of the SQL validation component in Ama

CVE-2026-79324 - Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/mo

CVE-2026-73789 - A vulnerability in the web-based management interface of CPPM guest account management services coul

CVE-2026-73788 - A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to eleva

CVE-2026-73787 - A vulnerability in the CPPM web interface could allow an authenticated remote attacker to access dir

CVE-2026-73786 - A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote

CVE-2026-73769 - A vulnerability in the web-based management interface of vulnerable CPPM systems could allow an auth

CVE-2026-71616 - An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of se

CVE-2026-71614 - An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary co

CVE-2026-71613 - Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to

CVE-2026-71612 - Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to

CVE-2026-61915 - An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authe

CVE-2026-61911 - An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An a

CVE-2026-61910 - An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use r

CVE-2026-61909 - An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL

CVE-2026-61908 - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an ou

CVE-2026-38998 - A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of L

CVE-2026-79323 - Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (mage

CVE-2026-79322 - SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-

CVE-2026-61907 - An issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox AC

CVE-2026-54694 - SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code fl

CVE-2026-52482 - An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensiti

CVE-2026-39020 - An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavef

CVE-2025-51619 - A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivi

CVE-2026-8044 - CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerabi

CVE-2026-87930 - MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions,

CVE-2026-87929 - MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config

CVE-2026-87928 - MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_pa

CVE-2026-87927 - MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxs

CVE-2026-87876 - Two case-insensitive comparisons on request-derived usernames outside the main authorization path in

CVE-2026-87875 - The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read p

CVE-2026-87874 - A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although

CVE-2026-87872 - A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible c

CVE-2026-87853 - A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compare

CVE-2026-85788 - Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-m

CVE-2026-80925 - In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and r

CVE-2026-80924 - In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensit

CVE-2026-80923 - In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on

CVE-2026-80922 - In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero a

CVE-2026-80921 - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale cry

CVE-2026-80920 - In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signali

CVE-2026-80919 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mu

CVE-2026-80918 - In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer t

CVE-2026-80917 - In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL poi

CVE-2026-80916 - In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and r

CVE-2026-80915 - In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix DPT allocation path

CVE-2026-80914 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix use-after-f

CVE-2026-77120 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') v

CVE-2026-70425 - Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Vers

CVE-2026-56125 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-49947 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-47156 - MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authenticatio

CVE-2026-46460 - Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and ver

CVE-2026-43645 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-43635 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-40635 - Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerab

CVE-2026-34412 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-28523 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-26350 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-24442 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-23855 - Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC

CVE-2026-19233 - CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized comma

CVE-2026-18147 - A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scrip

CVE-2026-82563 - An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emula

CVE-2026-81640 - An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weake

CVE-2026-81330 - The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP str

CVE-2026-79947 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79946 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79945 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79944 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79942 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79741 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79735 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79693 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79689 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-78493 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-78484 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-77974 - After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the

CVE-2026-68484 - Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Adminis

CVE-2026-67403 - Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insuffi

CVE-2026-67401 - A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root thr

CVE-2026-22591 - eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG

CVE-2026-22590 - eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG

CVE-2026-87877 - zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and

CVE-2026-87825 - zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a d

CVE-2026-87824 - zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect

CVE-2026-87823 - zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size

CVE-2026-87822 - t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingD

CVE-2026-83530 - A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit(

CVE-2026-82530 - IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vul

CVE-2026-79941 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79736 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79732 - Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper

CVE-2026-79729 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79690 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79617 - Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Techn

CVE-2026-78482 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-26212 - Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulne

CVE-2026-86775 - knowns (npm package) versions <= 0.29.1 contain a path traversal vulnerability in the Document API.

CVE-2026-86774 - Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy whe

CVE-2026-86773 - Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, upd

CVE-2026-86772 - Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPres

CVE-2026-86771 - Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF gene

CVE-2026-86770 - Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication, allowi

CVE-2026-86769 - Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consuma

CVE-2026-86768 - Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authe

CVE-2026-86767 - Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested

CVE-2026-86766 - Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable chec

CVE-2026-86765 - Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are sub

CVE-2026-86764 - Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authe

CVE-2026-86763 - Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer co

CVE-2026-86762 - Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware gro

CVE-2026-86761 - snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpo

CVE-2026-86760 - Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in ap

CVE-2026-86759 - Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any a

CVE-2026-86758 - Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and AP

CVE-2026-86757 - Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form t

CVE-2026-86756 - Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer

CVE-2026-86755 - Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-toke

CVE-2026-86754 - Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo

CVE-2026-86753 - snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /a

CVE-2026-86752 - snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, r

CVE-2026-86751 - Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth

CVE-2026-86750 - Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before

CVE-2026-86749 - Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operation

CVE-2026-86748 - Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in th

CVE-2026-86747 - Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the re

CVE-2026-86746 - Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enf

CVE-2026-86745 - Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the co

CVE-2026-86744 - Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race conditi

CVE-2026-86743 - Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, al

CVE-2026-86742 - Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance re

CVE-2026-86741 - Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in

CVE-2026-86740 - Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesControlle

CVE-2026-86739 - Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signatur

CVE-2026-86204 - PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket hand

CVE-2026-86203 - PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack pa

CVE-2026-86202 - PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPack

CVE-2026-86201 - PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing whe

CVE-2026-86200 - PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket ha

CVE-2026-86199 - PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline

CVE-2026-86198 - PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePa

CVE-2026-86099 - Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowin

CVE-2026-79971 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79964 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79952 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79950 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79740 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79738 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79731 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-78486 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-78483 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-73324 - Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerabili

CVE-2026-64857 - tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During auth

CVE-2026-56711 - VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when

CVE-2025-71418 - PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowin

CVE-2025-71417 - PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponse

CVE-2024-58382 - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdo

CVE-2024-58381 - PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processin

CVE-2024-58380 - PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket han

CVE-2023-54396 - PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deseria

CVE-2023-54395 - PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponseP

CVE-2023-54394 - PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requ

CVE-2023-54393 - PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON p

CVE-2023-54392 - PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate

CVE-2023-54390 - PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPac

CVE-2023-54355 - PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginP

CVE-2026-85103 - A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote a

CVE-2026-85102 - Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway

CVE-2026-80169 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79969 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79968 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79966 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79965 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79962 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79961 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79728 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79694 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-79638 - Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5

CVE-2026-15140 - A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only

CVE-2026-87821 - Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/a

CVE-2026-87820 - CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that d

CVE-2026-87819 - GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_

CVE-2026-87818 - GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attack

CVE-2026-87817 - GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to

CVE-2026-87816 - PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit en

CVE-2026-87815 - SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck

CVE-2026-87814 - SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset previe

CVE-2026-87813 - SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets resul

CVE-2026-87812 - SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards wh

CVE-2026-87811 - SiYuan before v3.8.2 inserts persisted notebook template paths into HTML input value attributes with

CVE-2026-87810 - Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTe

CVE-2026-87809 - Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in

CVE-2026-87808 - SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The pri

CVE-2026-87807 - siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSe

CVE-2026-87806 - Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in th