CVE-2026-12843 - The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.

CVE-2026-10196 - The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPr

CVE-2025-9049 - The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification

CVE-2025-15647 - CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function whe

CVE-2025-15614 - ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when proce

CVE-2026-86178 - Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and commen

CVE-2026-86177 - Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task crea

CVE-2026-86176 - NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints

CVE-2026-86175 - NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL A

CVE-2026-86174 - Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public

CVE-2026-86173 - MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handl

CVE-2026-86169 - Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path whe

CVE-2026-86124 - AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that bin

CVE-2026-86123 - SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection

CVE-2026-86122 - Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated u

CVE-2026-86121 - Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment v

CVE-2026-86120 - APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGu

CVE-2026-86119 - Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in t

CVE-2026-86118 - gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, al

CVE-2026-86117 - Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler

CVE-2026-86116 - Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpo

CVE-2026-86115 - Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme n

CVE-2026-86114 - Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user ro

CVE-2026-86113 - BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough functi

CVE-2026-86112 - BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite

CVE-2026-86111 - BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, al

CVE-2026-76573 - The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site S

CVE-2024-11080 - The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticat

CVE-2026-85414 - The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cust

CVE-2026-83625 - The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

CVE-2026-81543 - The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in

CVE-2026-75586 - The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scri

CVE-2026-75018 - The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions

CVE-2026-84937 - The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape us

CVE-2026-84936 - The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-

CVE-2026-84935 - The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check

CVE-2026-84934 - The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its aut

CVE-2026-84931 - The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode att

CVE-2026-84930 - The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly valida

CVE-2026-84927 - The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on o

CVE-2026-84926 - The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Googl

CVE-2026-84901 - The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its

CVE-2026-84899 - The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute b

CVE-2026-84898 - The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before

CVE-2026-84896 - The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-styl

CVE-2026-84745 - The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the use

CVE-2026-84225 - The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collabora

CVE-2026-84221 - The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it

CVE-2026-84022 - The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode a

CVE-2026-84021 - The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before out

CVE-2026-83544 - The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute

CVE-2026-83543 - The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching

CVE-2026-82846 - The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings b

CVE-2026-82304 - The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using

CVE-2026-81424 - The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled

CVE-2026-81423 - The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL befor

CVE-2026-81404 - The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before r

CVE-2026-81348 - The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to

CVE-2026-78438 - The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con

CVE-2026-78362 - The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential

CVE-2026-78150 - The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the po

CVE-2026-78149 - The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected be

CVE-2026-77830 - The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored C

CVE-2026-77826 - The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook

CVE-2026-4361 - The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and

CVE-2026-3853 - The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the `image_s

CVE-2026-19887 - The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up

CVE-2026-19861 - The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly s

CVE-2026-19858 - The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform au

CVE-2026-19769 - The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to

CVE-2026-18843 - The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Reflected Cross-Si

CVE-2026-18406 - The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is

CVE-2026-16649 - The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Fi

CVE-2026-15984 - The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Para

CVE-2026-15247 - The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check be

CVE-2026-14975 - The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to

CVE-2025-15694 - The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its se

CVE-2025-15693 - The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided

CVE-2026-8625 - The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnera

CVE-2026-8623 - The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnera

CVE-2026-86145 - PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace

CVE-2026-83628 - The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, an

CVE-2026-83627 - The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulner

CVE-2026-77263 - The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu

CVE-2026-77233 - The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vu

CVE-2026-18404 - The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site S

CVE-2026-13447 - The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versio

CVE-2025-14945 - The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to St

CVE-2026-86144 - In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate

CVE-2026-86143 - In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes n

CVE-2026-86142 - In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xm

CVE-2026-86141 - xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a str

CVE-2026-86140 - In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

CVE-2026-86139 - In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

CVE-2026-86138 - In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-bas

CVE-2026-86137 - In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds rea

CVE-2026-86100 - Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote fil

CVE-2026-52777 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP objec

CVE-2026-52775 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest developm

CVE-2026-52774 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler refl

CVE-2026-52773 - YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archi

CVE-2026-52772 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still ap

CVE-2026-52771 - YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::

CVE-2026-52770 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listin

CVE-2026-52769 - YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/f

CVE-2026-52767 - YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureSe

CVE-2026-52766 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki ac

CVE-2026-52763 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/r

CVE-2026-52762 - YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Ser

CVE-2026-86098 - ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_e

CVE-2026-86097 - PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_

CVE-2026-86096 - PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::star

CVE-2026-86095 - Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attnam

CVE-2026-48019 - Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vuln

CVE-2026-86091 - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing

CVE-2026-86090 - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipient

CVE-2026-82684 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization

CVE-2026-77393 - In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which pe

CVE-2026-76925 - A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `o

CVE-2026-75925 - Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker

CVE-2026-46636 - Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::ch

CVE-2026-85787 - An incomplete list of disallowed inputs in the SQL validation component in Amazon awslabs postgres-m

CVE-2026-85704 - A security flaw has been discovered in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f1

CVE-2026-85703 - A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc.

CVE-2026-85702 - A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca92

CVE-2026-85701 - A vulnerability has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10e

CVE-2026-82712 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request for

CVE-2026-79426 - An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6

CVE-2026-79423 - An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seac

CVE-2026-77847 - Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded cred

CVE-2026-75439 - An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF compon

CVE-2026-75438 - Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of servic

CVE-2026-53769 - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before vers

CVE-2026-50894 - easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the backgroun

CVE-2025-67066 - SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary

CVE-2022-26961 - Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/bac

CVE-2026-85786 - Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote atta

CVE-2026-85643 - A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli_q

CVE-2026-79391 - No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client co

CVE-2026-79390 - Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT com

CVE-2026-79389 - Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker

CVE-2026-71626 - An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the

CVE-2026-71625 - An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the Res

CVE-2026-71624 - An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models

CVE-2026-71622 - SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensi

CVE-2026-63464 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before v

CVE-2026-61699 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revoca

CVE-2026-55513 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before v

CVE-2026-55512 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before v

CVE-2026-53932 - laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1

CVE-2026-53604 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the we

CVE-2026-53603 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operat

CVE-2026-53602 - nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two re

CVE-2026-85781 - Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CS

CVE-2026-85639 - A security vulnerability has been detected in jofpin trape 2.0. This vulnerability affects unknown c

CVE-2026-85638 - A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/us

CVE-2026-85637 - A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the functio

CVE-2026-81939 - A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and arc

CVE-2026-80119 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80118 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80117 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80116 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80115 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80114 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80113 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-80112 - PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics

CVE-2026-78839 - An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrar

CVE-2026-78328 - A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Manage

CVE-2026-78327 - An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulner

CVE-2026-71620 - File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitr

CVE-2026-9317 - Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that a

CVE-2026-85769 - A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM

CVE-2026-85656 - An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.

CVE-2026-85654 - Improper neutralization of special elements used in a template engine in the CDK generator in Amazon

CVE-2026-85636 - A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown f

CVE-2026-84890 - undici's decompress interceptor decompresses response bodies according to the untrusted Content-Enco

CVE-2026-82538 - ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository

CVE-2026-80913 - In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean

CVE-2026-80912 - In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed cl

CVE-2026-80911 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: sof-audio: Fix error

CVE-2026-80910 - In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro:

CVE-2026-80909 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message

CVE-2026-80908 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message

CVE-2026-80907 - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min siz

CVE-2026-80906 - In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transpor

CVE-2026-80905 - In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transport_h

CVE-2026-80904 - In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_rea

CVE-2026-80903 - In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix sync entry leak

CVE-2026-80902 - In the Linux kernel, the following vulnerability has been resolved: dmaengine: sun6i-dma: Fix recla

CVE-2026-80901 - In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validati

CVE-2026-80900 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Make UMP message si

CVE-2026-80899 - In the Linux kernel, the following vulnerability has been resolved: erofs: remove fscache backend e

CVE-2026-80898 - In the Linux kernel, the following vulnerability has been resolved: netfs: clear PG_private_2 on co

CVE-2026-80897 - In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios

CVE-2026-80896 - In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_de

CVE-2026-80895 - In the Linux kernel, the following vulnerability has been resolved: mshv: Order pt_vp_array publish

CVE-2026-80894 - In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed

CVE-2026-80893 - In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix swap entry corr

CVE-2026-80892 - In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool siz

CVE-2026-80891 - In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Validate AIBV a

CVE-2026-80890 - In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with

CVE-2026-80889 - In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix timer drain ord

CVE-2026-80888 - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dma_buf refere

CVE-2026-80887 - In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: use check_add_overf

CVE-2026-73848 - Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog ar

CVE-2026-61688 - SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can

CVE-2026-61686 - SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveCompon

CVE-2026-61614 - SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticato

CVE-2026-61608 - SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, `UserInvitation` entities

CVE-2026-57166 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a

CVE-2026-57165 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b7

CVE-2026-57164 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit 8d595

CVE-2026-57163 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit c4a15

CVE-2026-57162 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit a1b70

CVE-2026-57161 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03

CVE-2026-57160 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e

CVE-2026-57159 - PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b9

CVE-2026-53761 - Frappe CRM is an open-source customer relationship management tool. Prior to version 1.73.0, there i

CVE-2026-53760 - Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugin

CVE-2026-53758 - Emlog is an open source website building system. In versions 2.6.29 and prior, article content is pr

CVE-2026-53757 - Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() functio

CVE-2026-53756 - Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a b

CVE-2026-50553 - Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates bo

CVE-2026-19534 - undici's WebSocket client crashes the whole Node.js process during the opening handshake when a serv

CVE-2026-18745 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-18540 - undici's retry interceptor can append the body of a ranged retry response to bytes already delivered

CVE-2026-18149 - undici's retry handler can leave an already-exposed response body pending forever. When a server ret

CVE-2021-44320 - Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (D

CVE-2021-44319 - Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform i

CVE-2026-85152 - undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the ca

CVE-2026-85024 - undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners

CVE-2026-85014 - undici's experimental WebSocketStream client crashes the whole Node.js process when a remote peer cl

CVE-2026-85008 - undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip c

CVE-2026-84961 - undici's BalancedPool constructor passes its entire options object through an internal deep-clone th

CVE-2026-84947 - undici's dump interceptor reads and discards a response body up to a configurable maximum size. When

CVE-2026-84933 - undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path

CVE-2026-80886 - In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for ke

CVE-2026-80885 - In the Linux kernel, the following vulnerability has been resolved: afs: Fix uncancelled rxrpc OOB

CVE-2026-80884 - In the Linux kernel, the following vulnerability has been resolved: ntb: Store original DMA address

CVE-2026-80883 - In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initializ

CVE-2026-80882 - In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - Return ENOMEM w

CVE-2026-80881 - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head manageme

CVE-2026-80880 - In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support impli

CVE-2026-80879 - In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dep

CVE-2026-80878 - In the Linux kernel, the following vulnerability has been resolved: afs: Fix leak of ungot volume

CVE-2026-80877 - In the Linux kernel, the following vulnerability has been resolved: afs: Fix vllist leak Fix a lea

CVE-2026-80876 - In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length w

CVE-2026-80875 - In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offs

CVE-2026-80874 - In the Linux kernel, the following vulnerability has been resolved: arm64: dts: renesas: ironhide:

CVE-2026-80873 - In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Write ESR_EL2 f