CVE-2026-54517 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-54516 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-54515 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-54514 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-54513 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-54512 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-53931 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-impor

CVE-2026-53930 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration en

CVE-2026-53929 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, with NC_SECURE_ATTACH

CVE-2026-53928 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a stolen refresh toke

CVE-2026-53927 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch

CVE-2026-53926 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, revokeAllOAuthTokensB

CVE-2026-50193 - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson

CVE-2026-47388 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP t

CVE-2026-47387 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared form-view

CVE-2026-47386 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, two concurrent token-

CVE-2026-47385 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user

CVE-2026-47384 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user

CVE-2026-47383 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated comm

CVE-2026-47382 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test e

CVE-2026-47381 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a user in one workspa

CVE-2026-47380 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, sign-in response timi

CVE-2026-47379 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the shared-view passw

CVE-2026-47378 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view en

CVE-2026-47377 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the client-side hashR

CVE-2026-47376 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset pa

CVE-2026-47375 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user

CVE-2026-47279 - NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the public shared-vie

CVE-2026-46554 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, deleted API tokens co

CVE-2026-46553 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the upload-by-URL pat

CVE-2026-46552 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, shared-base sessions

CVE-2026-46551 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.4, the uploadViaURL path

CVE-2026-46550 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token coo

CVE-2026-46549 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the OAuth token strat

CVE-2026-46548 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering

CVE-2026-46547 - NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, a reflected XSS vulne

CVE-2026-41862 - Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialis

CVE-2026-23513 - FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior

CVE-2026-12892 - A flaw was found in GStreamer's gst-plugins-bad package. When processing a specially crafted H.264 v

CVE-2026-12891 - A flaw was found in the GStreamer gst-plugins-bad package. When processing a malformed H.266/VVC vid

CVE-2026-12112 - A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server all

CVE-2026-11820 - A flaw was found in the community.general Ansible collection's nexmo module. The module constructs H

CVE-2026-11819 - Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE-2026-11807 - A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The

CVE-2025-64105 - FOSSBilling is a billing and client management system that automates invoicing, payments, and commun

CVE-2026-54762 - Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium s

CVE-2026-54761 - Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high sever

CVE-2026-54555 - rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the

CVE-2026-54328 - Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or

CVE-2026-54327 - Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi stored API keys and OAuth cred

CVE-2026-54326 - Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Ma

CVE-2026-54325 - Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and res

CVE-2026-53622 - Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerabilit

CVE-2026-48491 - Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity

CVE-2026-48020 - Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a

CVE-2026-45792 - rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK

CVE-2026-39253 - An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivot

CVE-2026-55736 - Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-

CVE-2026-55249 - @rtk-ai/rtk-rewrite transparently rewrites shell commands executed via OpenClaw's exec tool to their

CVE-2026-54322 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-54321 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-54320 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-54319 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-53755 - Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.9, the Docker API server

CVE-2026-53754 - Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server

CVE-2026-53753 - Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expres

CVE-2026-57062 - CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS forma

CVE-2026-57053 - GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs

CVE-2026-55517 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.5, a Deno program that opens

CVE-2026-54324 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-54323 - Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor

CVE-2026-54318 - Home Assistant is open source home automation software that puts local control and privacy first. Pr

CVE-2026-54317 - Home Assistant is open source home automation software that puts local control and privacy first. Pr

CVE-2026-54316 - Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.

CVE-2026-54257 - Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C

CVE-2026-54157 - LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow

CVE-2026-54022 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54021 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54019 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54018 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54016 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54015 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54014 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54013 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54012 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54011 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54010 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54009 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54008 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54007 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-54006 - Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P

CVE-2026-53662 - immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 u

CVE-2026-52846 - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy’s stripHTML

CVE-2026-52845 - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_

CVE-2026-52844 - Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy

CVE-2026-50221 - In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-H

CVE-2026-49983 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gat

CVE-2026-49860 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when a WebSocket connecti

CVE-2026-49859 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called,

CVE-2026-49440 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, node:crypto.checkPrime(ca

CVE-2026-49411 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.0, the Node.js compatibility

CVE-2026-49406 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.12, when Deno was run in BYO

CVE-2026-49402 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_proces

CVE-2026-49401 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system

CVE-2026-45692 - Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the author

CVE-2026-45135 - Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCG

CVE-2026-44726 - Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's

CVE-2026-0864 - When using the "configparser" module to write configuration files containing multi-line text values

CVE-2025-71382 - MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering e

CVE-2025-61029 - An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cau

CVE-2025-61024 - An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers

CVE-2020-9713 - Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and ear

CVE-2020-9711 - Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier a

CVE-2020-9695 - Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier a

CVE-2026-56968 - GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM

CVE-2026-56117 - dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the

CVE-2026-56116 - dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Rou

CVE-2026-56115 - Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low

CVE-2026-56114 - dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulner

CVE-2026-56113 - dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that al

CVE-2026-55450 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut

CVE-2026-55447 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by co

CVE-2026-55446 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an a

CVE-2026-55423 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the l

CVE-2026-55255 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an In

CVE-2026-54308 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent36

CVE-2026-54307 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-

CVE-2026-54306 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollutio

CVE-2026-54305 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE

CVE-2026-54304 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.1, an authen

CVE-2026-54302 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen

CVE-2026-54301 - n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen

CVE-2026-50574 - yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an extern

CVE-2026-50023 - yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-d

CVE-2026-50019 - yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used a

CVE-2026-49465 - n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authen

CVE-2026-49444 - n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, and 2.22.4, an authen

CVE-2026-48520 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the

CVE-2026-48519 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "

CVE-2026-45732 - n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth

CVE-2026-44961 - The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As

CVE-2026-44960 - A stored XSS can be exploited by leveraging the usernames as an attack vector. When an admin user vi

CVE-2026-44959 - A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6

CVE-2026-44958 - An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Reviv

CVE-2026-44957 - A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Ads

CVE-2026-44956 - Low‑privileged users could use their Full Name as a vector for a stored XSS attack. The name is incl

CVE-2026-44792 - n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attack

CVE-2026-44791 - n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen

CVE-2026-44790 - n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen

CVE-2026-44789 - n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen

CVE-2026-42867 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langf

CVE-2026-34917 - Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, w

CVE-2026-34916 - A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and ear

CVE-2026-34915 - A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear

CVE-2026-34914 - A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear

CVE-2026-34913 - A missing access control check when linking trackers to campaigns through the campaign-trackers.php

CVE-2026-34912 - A missing access control check when linking banners or campaigns to a zone through the zone-include.

CVE-2026-33760 - Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langf

CVE-2026-13007 - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose

CVE-2026-12958 - Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of

CVE-2026-12957 - Improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all support

CVE-2026-11940 - tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a

CVE-2025-61028 - An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to c

CVE-2025-61027 - An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cau

CVE-2025-61025 - An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to c

CVE-2025-61023 - An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cau

CVE-2025-61022 - An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers

CVE-2025-61021 - An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows atta

CVE-2025-61020 - An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attacker

CVE-2025-61019 - An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attacker

CVE-2025-61018 - An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers

CVE-2025-13162 - Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master

CVE-2026-56696 - OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing

CVE-2026-56695 - OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allow

CVE-2026-56694 - NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration appr

CVE-2026-56693 - NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-ac

CVE-2026-56692 - NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allow

CVE-2026-56402 - NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse

CVE-2026-55767 - Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with

CVE-2026-55766 - guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/p

CVE-2026-55568 - Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expecte

CVE-2026-54314 - n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompre

CVE-2026-54313 - n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with work

CVE-2026-54312 - n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with perm

CVE-2026-54311 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use

CVE-2026-54310 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use

CVE-2026-54309 - n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browse

CVE-2026-54303 - n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Mic

CVE-2026-52673 - SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitra

CVE-2025-62180 - Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that

CVE-2025-55639 - GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind(

CVE-2025-15619 - HCL Connections contains a broken access control vulnerability that may allow an unauthorized user t

CVE-2026-56815 - pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in th

CVE-2026-35019 - NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulner

CVE-2026-35018 - NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code ex

CVE-2026-28496 - FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 hav

CVE-2026-27604 - FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 a

CVE-2026-12969 - An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When p

CVE-2026-11772 - DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can

CVE-2026-10609 - A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creat

CVE-2026-56784 - OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bu

CVE-2026-56762 - Hono before 4.12.12 does not validate cookie names on the write path in the setCookie(), serialize()

CVE-2026-56701 - Grav before 2.0.0-beta.2 contains an XML external entity injection vulnerability in SVG file upload

CVE-2026-56379 - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG deco

CVE-2026-56376 - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a heap use-after-free in the meta coder: when mem

CVE-2026-56371 - ImageMagick before 7.1.2-15 and 6.9.13-40 contains a memory leak in coders/txt.c when processing TXT

CVE-2026-56322 - Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updat

CVE-2026-56315 - picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uui

CVE-2026-56301 - Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on

CVE-2026-56275 - Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node t

CVE-2026-56274 - Flowise before 3.1.2 contains multiple OS command injection vulnerabilities in the Custom MCP Server

CVE-2026-56263 - Crawl4AI before 0.8.7 contains a stored cross-site scripting vulnerability in the monitor dashboard

CVE-2026-56258 - Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpo

CVE-2026-56248 - Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerab

CVE-2026-56243 - Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane

CVE-2026-56234 - Capgo before 12.128.2 contains a credential validation vulnerability in the POST /functions/v1/priva

CVE-2026-56225 - Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key managemen

CVE-2026-56222 - Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings

CVE-2026-54892 - Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remo

CVE-2026-4610 - The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored

CVE-2026-44089 - Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstec

CVE-2026-10857 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-10711 - Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I

CVE-2025-71376 - picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoCompl

CVE-2025-71370 - picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper func

CVE-2025-71365 - picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.

CVE-2025-71341 - picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle f

CVE-2025-71337 - Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vuln

CVE-2023-54365 - Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 req

CVE-2026-4983 - Open VSX Registry does not sanitize SVG files uploaded as extension icons prior to storage, and serv

CVE-2026-11374 - In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the S

CVE-2026-9733 - Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state

CVE-2026-10521 - An high privileged remote attacker can access a hidden configuration method, that should not be acce

CVE-2026-8379 - The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce c

CVE-2026-8378 - The Frontend File Manager Plugin WordPress plugin through 23.6 does not sanitise nor escape a filena

CVE-2026-8172 - The Simple Basic Contact Form WordPress plugin through 20250114 does not escape user-supplied input

CVE-2026-8163 - The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some param

CVE-2026-7842 - The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize

CVE-2026-12866 - All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. A

CVE-2026-55655 - A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-

CVE-2026-55654 - A flaw was found in OpenSSH. This vulnerability, a heap out-of-bounds read, occurs during the cleanu

CVE-2026-55653 - A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the D

CVE-2026-11833 - Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a r

CVE-2026-10658 - bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timest

CVE-2026-10651 - bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record b

CVE-2026-10645 - The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec

CVE-2026-54236 - vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fi

CVE-2026-54235 - vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, ll tem

CVE-2026-54233 - vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's

CVE-2026-54232 - vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.1, the vLLM