CVE-2026-10597 - OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unau

CVE-2026-8653 - The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'co

CVE-2026-7764 - An out-of-bounds read vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLi

CVE-2026-10737 - The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a

CVE-2026-8722 - Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric name

CVE-2026-10783 - A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audi

CVE-2026-2596 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-10777 - A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8

CVE-2026-10775 - A vulnerability was determined in sgl-project SGLang up to 0.5.11. Affected by this vulnerability is

CVE-2026-46447 - OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can se

CVE-2026-22055 - Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated

CVE-2026-22054 - Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authentic

CVE-2026-10771 - A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntit

CVE-2026-50033 - Local privilege escalation due to DLL hijacking vulnerability. The following products are affected:

CVE-2026-44682 - Local privilege escalation due to DLL hijacking vulnerability. The following products are affected:

CVE-2026-44609 - Local privilege escalation due to EXE hijacking vulnerability. The following products are affected:

CVE-2026-43924 - FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the

CVE-2026-42061 - Local privilege escalation due to excessive permissions assigned to child processes. The following p

CVE-2026-40495 - FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 lea

CVE-2026-37700 - Cross Site Scripting vulnerability in MaxSite CMS v.109.2 allows a remote attacker to obtain sensiti

CVE-2026-26825 - A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files.

CVE-2026-26824 - libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE contain

CVE-2026-10766 - A vulnerability has been found in mlrun up to 1.12.0-rc3. This impacts the function mlrun.utils.help

CVE-2026-8889 - Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matchin

CVE-2026-8888 - Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-pr

CVE-2026-8881 - Version 3.0.7 of the Securly Chrome Extension uses EVP_BytesToKey key derivation with MD5 and a sing

CVE-2026-8879 - Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content sc

CVE-2026-8878 - Version 3.0.7 of the Securly Chrome Extension exposes multiple publicly accessible endpoints that al

CVE-2026-8876 - Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in secur

CVE-2026-8874 - Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords

CVE-2026-7888 - Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workfl

CVE-2026-45702 - OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r

CVE-2026-45614 - OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r

CVE-2026-42840 - An authenticated user can persist arbitrary HTML/JavaScript in the email_id or mobile_no fields of a

CVE-2026-42839 - An authenticated ERPNext user with Item record edit permissions can persist arbitrary HTML/JavaScrip

CVE-2026-26379 - Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/

CVE-2026-26378 - Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbi

CVE-2026-46273 - In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packet

CVE-2026-46272 - In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race co

CVE-2026-46271 - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads o

CVE-2026-46270 - In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-

CVE-2026-46269 - In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL

CVE-2026-46268 - In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Fix p2pmem_alloc_mm

CVE-2026-46267 - In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers an

CVE-2026-46266 - In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTO

CVE-2026-46265 - In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM wa

CVE-2026-46264 - In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initializa

CVE-2026-46263 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bou

CVE-2026-46262 - In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_xcvr: Revert fix miss

CVE-2026-46261 - In the Linux kernel, the following vulnerability has been resolved: spi: wpcm-fiu: Fix potential NU

CVE-2026-46260 - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access i

CVE-2026-46259 - In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protect

CVE-2026-46258 - In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Avoid NULL derefere

CVE-2026-46257 - In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804

CVE-2026-46256 - In the Linux kernel, the following vulnerability has been resolved: NFS/localio: prevent direct rec

CVE-2026-46255 - In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: don't expl

CVE-2026-46254 - In the Linux kernel, the following vulnerability has been resolved: AppArmor: Allow apparmor to han

CVE-2026-46253 - In the Linux kernel, the following vulnerability has been resolved: pstore/ram: fix buffer overflow

CVE-2026-46252 - In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix locking in

CVE-2026-46251 - In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block_group_tree dir

CVE-2026-46250 - In the Linux kernel, the following vulnerability has been resolved: MIPS: Work around LLVM bug when

CVE-2026-46249 - In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix PF driver cra

CVE-2026-46248 - In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: clear stale link

CVE-2026-46247 - In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gfx3d: add parent to

CVE-2026-46246 - In the Linux kernel, the following vulnerability has been resolved: power: supply: pm8916_lbc: Fix

CVE-2026-46245 - In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NU

CVE-2026-46244 - In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6

CVE-2026-40290 - OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r

CVE-2026-39107 - A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. T

CVE-2026-36618 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries,

CVE-2026-36616 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials

CVE-2026-36615 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset e

CVE-2026-36613 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized internal

CVE-2026-36612 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 enables WPS 2.0 by default with a weak lock

CVE-2026-36611 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w

CVE-2026-36610 - Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext H

CVE-2026-36609 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce t

CVE-2026-36608 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forwar

CVE-2026-36607 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force a

CVE-2026-36606 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with

CVE-2026-36605 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of se

CVE-2026-36604 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host head

CVE-2026-36603 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions wi

CVE-2026-36602 - Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via t

CVE-2026-36460 - Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerabili

CVE-2026-20233 - A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauth

CVE-2026-20230 - A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communication

CVE-2026-20175 - A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary f

CVE-2025-71314 - In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Recover from panth

CVE-2025-71313 - In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL

CVE-2019-25720 - Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-o

CVE-2026-6657 - A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS o

CVE-2026-44281 - GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versi

CVE-2026-42321 - GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to ver

CVE-2026-42320 - GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versi

CVE-2026-42318 - GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to vers

CVE-2026-42317 - GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versi

CVE-2026-3276 - unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input

CVE-2026-37462 - An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows

CVE-2026-36748 - RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media link

CVE-2026-36576 - An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up

CVE-2026-36574 - A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escal

CVE-2022-31114 - backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of

CVE-2026-8404 - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.U

CVE-2026-7666 - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.core.mail.backends

CVE-2026-6873 - An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.g

CVE-2026-5241 - A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows

CVE-2026-48587 - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.utils.cache.has_va

CVE-2026-47325 - ProjectsAndPrograms school-management-system uses predictable credentials by generating student's an

CVE-2026-47324 - ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in m

CVE-2026-44546 - daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to au

CVE-2026-44545 - daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocke

CVE-2026-37460 - Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.

CVE-2026-35193 - An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.U

CVE-2026-10729 - An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" C

CVE-2025-70101 - An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.

CVE-2025-70100 - A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the

CVE-2025-60477 - A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filt

CVE-2024-47273 - An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in B

CVE-2024-47263 - An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in B

CVE-2023-52951 - A cleartext transmission of sensitive information vulnerability in Synology Note Station Client befo

CVE-2022-49042 - An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in

CVE-2022-49036 - An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration i

CVE-2026-35085 - A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to ga

CVE-2026-35084 - A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain

CVE-2026-35083 - A remote attacker with user privileges can exploit a stack buffer overflow to gain full system acces

CVE-2026-35082 - The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files

CVE-2026-35081 - The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processe

CVE-2026-35080 - The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local f

CVE-2026-35079 - The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files

CVE-2026-35078 - The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local file

CVE-2026-35077 - The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local

CVE-2026-35076 - The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local fi

CVE-2026-35075 - An unauthenticated remote attacker can recover a default, hard coded password from a firmware image

CVE-2026-10722 - A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of

CVE-2025-41259 - SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allo

CVE-2026-47065 - ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Pro

CVE-2026-41032 - It is possible for an unauthenticated adjacent attacker to download log files of the controller, whi

CVE-2025-15656 - Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalati

CVE-2025-15655 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2025-14774 - Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVE-2025-14773 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2025-14772 - Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affect

CVE-2025-14771 - Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue aff

CVE-2026-4035 - A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment v

CVE-2025-15654 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-5078 - Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the

CVE-2026-50052 - In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing c

CVE-2026-50031 - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intell

CVE-2026-10705 - A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of th

CVE-2026-10704 - A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulne

CVE-2026-10703 - A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the func

CVE-2026-9516 - Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input

CVE-2026-9334 - Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when d

CVE-2026-10694 - A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this iss

CVE-2026-10693 - A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Aff

CVE-2026-9732 - The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross

CVE-2026-7421 - The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versi

CVE-2026-10692 - A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function

CVE-2026-10691 - A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts a

CVE-2026-10690 - A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function

CVE-2026-44654 - LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in

CVE-2026-44653 - LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in

CVE-2026-42507 - When returning errors, functions in the net/textproto package would include its input as part of the

CVE-2026-42504 - Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessi

CVE-2026-41412 - alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet

CVE-2026-40108 - GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a techni

CVE-2026-35482 - alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet

CVE-2026-32625 - LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in

CVE-2026-31942 - LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in

CVE-2026-27145 - (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject A

CVE-2026-25861 - QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerabilit

CVE-2026-10719 - Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on a

CVE-2026-10718 - Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all

CVE-2026-10717 - Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3

CVE-2026-10688 - A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8

CVE-2026-10662 - A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Th

CVE-2026-8936 - Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container create

CVE-2026-42029 - Rejected reason: This CVE is a duplicate of another CVE.

CVE-2026-35212 - OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.

CVE-2026-10661 - A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8

CVE-2026-10650 - A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_

CVE-2025-15653 - Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local se

CVE-2024-14036 - Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability

CVE-2022-4992 - Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG

CVE-2021-4481 - Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability

CVE-2021-4480 - Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability

CVE-2026-49448 - authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1,

CVE-2026-49443 - authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1,

CVE-2026-49144 - BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handl

CVE-2026-49143 - BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP h

CVE-2026-47201 - authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1,

CVE-2026-45289 - CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Be

CVE-2026-42849 - authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the

CVE-2026-41569 - authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider

CVE-2026-10624 - A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vul

CVE-2026-10620 - A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function

CVE-2026-10619 - A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93

CVE-2026-8036 - Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system

CVE-2026-8035 - Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause

CVE-2026-5385 - An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowle

CVE-2026-5076 - The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in a

CVE-2026-5074 - The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parame

CVE-2026-5073 - The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter o

CVE-2026-49120 - Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worke

CVE-2026-48682 - FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser.

CVE-2026-48598 - Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part he

CVE-2026-48597 - Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows deni

CVE-2026-48596 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulner

CVE-2026-48595 - Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage

CVE-2026-48594 - Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla

CVE-2026-47265 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1

CVE-2026-42342 - React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.

CVE-2026-42211 - React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a c

CVE-2026-41577 - authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML so

CVE-2026-40181 - React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certa

CVE-2026-38967 - CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response

CVE-2026-35202 - Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterod

CVE-2026-35049 - wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon r

CVE-2026-34993 - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1

CVE-2026-34077 - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unst

CVE-2026-33553 - Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.

CVE-2026-33245 - React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unst

CVE-2026-30586 - Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sen

CVE-2026-28299 - SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when ex

CVE-2026-1829 - The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution

CVE-2026-10702 - JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox

CVE-2026-10701 - Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firef

CVE-2026-10617 - A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the

CVE-2026-10616 - A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the

CVE-2026-10608 - A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the fi

CVE-2026-10607 - A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspec

CVE-2026-10584 - Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, w

CVE-2025-64390 - A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02.

CVE-2021-4479 - Dräger Atlan A350 versions 1.00 up to and including 1.01 contains an improper input handling vulnera

CVE-2021-4478 - Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-boun

CVE-2019-25724 - Dräger Infinity M300 patient worn monitors with software version VG2.x and earlier contain a network

CVE-2019-25723 - Dräger Perseus A500 software versions 2.00 through 2.02 contains an improper input handling vulnerab

CVE-2019-25722 - Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded

CVE-2019-25721 - Dräger Infinity M300 patient worn monitors with software version VG2.3.1 and earlier contain a netwo

CVE-2026-49943 - CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP

CVE-2026-42074 - OpenClaude is an open-source coding-agent command line interface for cloud and local model providers

CVE-2026-42073 - OpenClaude is an open-source coding-agent command line interface for cloud and local model providers

CVE-2026-40715 - Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access Control vulnerab

CVE-2026-40713 - Dell ThinOS 10, versions prior to ThinOS10 2602_10.0765, contain an Improper Access control vulnerab

CVE-2026-40571 - NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePo

CVE-2026-40314 - NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePos

CVE-2026-35447 - NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Co

CVE-2026-35443 - NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/Forum

CVE-2026-33244 - React Router is a router for React. In versions 7.5.1 through 7.13.1, when using Framework Mode with